CVE-2026-64529

In the Linux kernel, the following vulnerability has been resolved:

crypto: qat - remove unused character device and IOCTLs

The QAT driver exposes a character device (qatadfctl) with IOCTLs for device configuration, start, stop, status query and enumeration. These IOCTLs are not part of any public uAPI header and have no known in-tree or out-of-tree users. Device lifecycle is already managed via sysfs.

The ioctl interface also increases the attack surface and is the subject of a number of bug reports.

Remove the character device, the IOCTL definitions, and the related data structures (adfdevstatusinfo, adfusercfgkeyval, adfusercfgsection, adfusercfgctldata). Drop the now-unused adfcfguser.h header and strip adfctldrv.c down to the minimal moduleinit/moduleexit hooks for workqueue, AER, and crypto/compression algorithm registration.

Clean up leftover dead code that was only reachable from the removed IOCTL paths: adfcfgdelall(), adfdevmgrverifyid(), adfdevmgrgetnumdev(), adfdevmgrgetdevbyid(), adfgetvfrealid() and the unused ADFCFG macros.

Additionally, drop the entry associated to QAT IOCTLs in ioctl-number.rst.