CVE-2025-39721

Repeated loading and unloading of a device specific QAT driver, for example qat4xxx, in a tight loop can lead to a crash due to a use-after-free scenario. This occurs when a power management (PM) interrupt triggers just before the device-specific driver (e.g., qat4xxx.ko) is unloaded, while the core driver (intel_qat.ko) remains loaded.

Since the driver uses a shared workqueue (qat_misc_wq) across all devices and owned by intel_qat.ko, a deferred routine from the device-specific driver may still be pending in the queue. If this routine executes after the driver is unloaded, it can dereference freed memory, resulting in a page fault and kernel crash like the following:

BUG: unable to handle page fault for address: ffa000002e50a01c
#PF: supervisor read access in kernel mode
RIP: 0010:pm_bh_handler+0x1d2/0x250 [intel_qat]
Call Trace:
  pm_bh_handler+0x1d2/0x250 [intel_qat]
  process_one_work+0x171/0x340
  worker_thread+0x277/0x3a0
  kthread+0xf0/0x120
  ret_from_fork+0x2d/0x50

To prevent this, flush the misc workqueue during device shutdown to ensure that all pending work items are completed before the driver is unloaded.

Note: This approach may slightly increase shutdown latency if the workqueue contains jobs from other devices, but it ensures correctness and stability.

References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

e5745f34113b758b45d134dec04a7df94dc67131

Fixed

5858448a6c65d8ee3f8600570d3ce19febcb33be

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

e5745f34113b758b45d134dec04a7df94dc67131

Fixed

fe546f5c50fc474daca6bee72caa7ab68a74c33d

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

e5745f34113b758b45d134dec04a7df94dc67131

Fixed

e59a52e429e13df3feb34f4853a8e36d121ed937

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

e5745f34113b758b45d134dec04a7df94dc67131

Fixed

3d4df408ba9bad2b205c7fb8afc1836a6a4ca88a

Affected versions

v5.*

v5.17

v5.17-rc2

v5.17-rc3

v5.17-rc4

v5.17-rc5

v5.17-rc6

v5.17-rc7

v5.17-rc8

v5.18

v5.18-rc1

v5.18-rc2

v5.18-rc3

v5.18-rc4

v5.18-rc5

v5.18-rc6

v5.18-rc7

v5.19

v5.19-rc1

v5.19-rc2

v5.19-rc3

v5.19-rc4

v5.19-rc5

v5.19-rc6

v5.19-rc7

v5.19-rc8

v6.*

v6.0

v6.0-rc1

v6.0-rc2

v6.0-rc3

v6.0-rc4

v6.0-rc5

v6.0-rc6

v6.0-rc7

v6.1

v6.1-rc1

v6.1-rc2

v6.1-rc3

v6.1-rc4

v6.1-rc5

v6.1-rc6

v6.1-rc7

v6.1-rc8

v6.10

v6.10-rc1

v6.10-rc2

v6.10-rc3

v6.10-rc4

v6.10-rc5

v6.10-rc6

v6.10-rc7

v6.11

v6.11-rc1

v6.11-rc2

v6.11-rc3

v6.11-rc4

v6.11-rc5

v6.11-rc6

v6.11-rc7

v6.12

v6.12-rc1

v6.12-rc2

v6.12-rc3

v6.12-rc4

v6.12-rc5

v6.12-rc6

v6.12-rc7

v6.12.1

v6.12.10

v6.12.11

v6.12.12

v6.12.13

v6.12.14

v6.12.15

v6.12.16

v6.12.17

v6.12.18

v6.12.19

v6.12.2

v6.12.20

v6.12.21

v6.12.22

v6.12.23

v6.12.24

v6.12.25

v6.12.26

v6.12.27

v6.12.28

v6.12.29

v6.12.3

v6.12.30

v6.12.31

v6.12.32

v6.12.33

v6.12.34

v6.12.35

v6.12.36

v6.12.37

v6.12.38

v6.12.39

v6.12.4

v6.12.40

v6.12.41

v6.12.42

v6.12.43

v6.12.5

v6.12.6

v6.12.7

v6.12.8

v6.12.9

v6.13

v6.13-rc1

v6.13-rc2

v6.13-rc3

v6.13-rc4

v6.13-rc5

v6.13-rc6

v6.13-rc7

v6.14

v6.14-rc1

v6.14-rc2

v6.14-rc3

v6.14-rc4

v6.14-rc5

v6.14-rc6

v6.14-rc7

v6.15

v6.15-rc1

v6.15-rc2

v6.15-rc3

v6.15-rc4

v6.15-rc5

v6.15-rc6

v6.15-rc7

v6.16

v6.16-rc1

v6.16-rc2

v6.16-rc3

v6.16-rc4

v6.16-rc5

v6.16-rc6

v6.16-rc7

v6.16.1

v6.16.2

v6.16.3

v6.2

v6.2-rc1

v6.2-rc2

v6.2-rc3

v6.2-rc4

v6.2-rc5

v6.2-rc6

v6.2-rc7

v6.2-rc8

v6.3

v6.3-rc1

v6.3-rc2

v6.3-rc3

v6.3-rc4

v6.3-rc5

v6.3-rc6

v6.3-rc7

v6.4

v6.4-rc1

v6.4-rc2

v6.4-rc3

v6.4-rc4

v6.4-rc5

v6.4-rc6

v6.4-rc7

v6.5

v6.5-rc1

v6.5-rc2

v6.5-rc3

v6.5-rc4

v6.5-rc5

v6.5-rc6

v6.5-rc7

v6.6

v6.6-rc1

v6.6-rc2

v6.6-rc3

v6.6-rc4

v6.6-rc5

v6.6-rc6

v6.6-rc7

v6.6.1

v6.6.10

v6.6.100

v6.6.101

v6.6.102

v6.6.11

v6.6.12

v6.6.13

v6.6.14

v6.6.15

v6.6.16

v6.6.17

v6.6.18

v6.6.19

v6.6.2

v6.6.20

v6.6.21

v6.6.22

v6.6.23

v6.6.24

v6.6.25

v6.6.26

v6.6.27

v6.6.28

v6.6.29

v6.6.3

v6.6.30

v6.6.31

v6.6.32

v6.6.33

v6.6.34

v6.6.35

v6.6.36

v6.6.37

v6.6.38

v6.6.39

v6.6.4

v6.6.40

v6.6.41

v6.6.42

v6.6.43

v6.6.44

v6.6.45

v6.6.46

v6.6.47

v6.6.48

v6.6.49

v6.6.5

v6.6.50

v6.6.51

v6.6.52

v6.6.53

v6.6.54

v6.6.55

v6.6.56

v6.6.57

v6.6.58

v6.6.59

v6.6.6

v6.6.60

v6.6.61

v6.6.62

v6.6.63

v6.6.64

v6.6.65

v6.6.66

v6.6.67

v6.6.68

v6.6.69

v6.6.7

v6.6.70

v6.6.71

v6.6.72

v6.6.73

v6.6.74

v6.6.75

v6.6.76

v6.6.77

v6.6.78

v6.6.79

v6.6.8

v6.6.80

v6.6.81

v6.6.82

v6.6.83

v6.6.84

v6.6.85

v6.6.86

v6.6.87

v6.6.88

v6.6.89

v6.6.9

v6.6.90

v6.6.91

v6.6.92

v6.6.93

v6.6.94

v6.6.95

v6.6.96

v6.6.97

v6.6.98

v6.6.99

v6.7

v6.7-rc1

v6.7-rc2

v6.7-rc3

v6.7-rc4

v6.7-rc5

v6.7-rc6

v6.7-rc7

v6.7-rc8

v6.8

v6.8-rc1

v6.8-rc2

v6.8-rc3

v6.8-rc4

v6.8-rc5

v6.8-rc6

v6.8-rc7

v6.9

v6.9-rc1

v6.9-rc2

v6.9-rc3

v6.9-rc4

v6.9-rc5

v6.9-rc6

v6.9-rc7

Database specific

vanir_signatures

[
    {
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "file": "drivers/crypto/intel/qat/qat_common/adf_common_drv.h"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fe546f5c50fc474daca6bee72caa7ab68a74c33d",
        "digest": {
            "line_hashes": [
                "300463152734477861155469999509099524007",
                "288796331039966203176762158159452029368",
                "61778264227304562568730194550342934459",
                "250114694481440085943839759425920137893"
            ],
            "threshold": 0.9
        },
        "signature_type": "Line",
        "id": "CVE-2025-39721-02506325"
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "function": "adf_dev_shutdown",
            "file": "drivers/crypto/intel/qat/qat_common/adf_init.c"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fe546f5c50fc474daca6bee72caa7ab68a74c33d",
        "digest": {
            "function_hash": "185721370723068638891904519569013585213",
            "length": 1502.0
        },
        "signature_type": "Function",
        "id": "CVE-2025-39721-0cc53e19"
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "function": "adf_dev_shutdown",
            "file": "drivers/crypto/intel/qat/qat_common/adf_init.c"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3d4df408ba9bad2b205c7fb8afc1836a6a4ca88a",
        "digest": {
            "function_hash": "185721370723068638891904519569013585213",
            "length": 1502.0
        },
        "signature_type": "Function",
        "id": "CVE-2025-39721-17123b17"
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "file": "drivers/crypto/intel/qat/qat_common/adf_init.c"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fe546f5c50fc474daca6bee72caa7ab68a74c33d",
        "digest": {
            "line_hashes": [
                "230987015914385084413466777182630723827",
                "57970423765352785627687001816990713206",
                "49595460635658217159839622543994908639",
                "179978352032813184033667693158657578305"
            ],
            "threshold": 0.9
        },
        "signature_type": "Line",
        "id": "CVE-2025-39721-2def59dc"
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "file": "drivers/crypto/intel/qat/qat_common/adf_init.c"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3d4df408ba9bad2b205c7fb8afc1836a6a4ca88a",
        "digest": {
            "line_hashes": [
                "230987015914385084413466777182630723827",
                "57970423765352785627687001816990713206",
                "49595460635658217159839622543994908639",
                "179978352032813184033667693158657578305"
            ],
            "threshold": 0.9
        },
        "signature_type": "Line",
        "id": "CVE-2025-39721-83d6c6b0"
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "target": {
            "file": "drivers/crypto/intel/qat/qat_common/adf_common_drv.h"
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3d4df408ba9bad2b205c7fb8afc1836a6a4ca88a",
        "digest": {
            "line_hashes": [
                "300463152734477861155469999509099524007",
                "288796331039966203176762158159452029368",
                "61778264227304562568730194550342934459",
                "250114694481440085943839759425920137893"
            ],
            "threshold": 0.9
        },
        "signature_type": "Line",
        "id": "CVE-2025-39721-d24b7aab"
    }
]

Linux / Kernel

Package

Name: Kernel

Affected ranges

Type: ECOSYSTEM
Events: Introduced

5.18.0

Fixed

6.6.103

Type: ECOSYSTEM
Events: Introduced

6.7.0

Fixed

6.12.44

Type: ECOSYSTEM
Events: Introduced

6.13.0

Fixed

6.16.4