CVE-2025-39721 (GCVE-0-2025-39721)

Vulnerability from cvelistv5 – Published: 2025-09-05 17:21 – Updated: 2026-05-11 21:34
VLAI
Title
crypto: qat - flush misc workqueue during device shutdown
Summary
In the Linux kernel, the following vulnerability has been resolved: crypto: qat - flush misc workqueue during device shutdown Repeated loading and unloading of a device specific QAT driver, for example qat_4xxx, in a tight loop can lead to a crash due to a use-after-free scenario. This occurs when a power management (PM) interrupt triggers just before the device-specific driver (e.g., qat_4xxx.ko) is unloaded, while the core driver (intel_qat.ko) remains loaded. Since the driver uses a shared workqueue (`qat_misc_wq`) across all devices and owned by intel_qat.ko, a deferred routine from the device-specific driver may still be pending in the queue. If this routine executes after the driver is unloaded, it can dereference freed memory, resulting in a page fault and kernel crash like the following: BUG: unable to handle page fault for address: ffa000002e50a01c #PF: supervisor read access in kernel mode RIP: 0010:pm_bh_handler+0x1d2/0x250 [intel_qat] Call Trace: pm_bh_handler+0x1d2/0x250 [intel_qat] process_one_work+0x171/0x340 worker_thread+0x277/0x3a0 kthread+0xf0/0x120 ret_from_fork+0x2d/0x50 To prevent this, flush the misc workqueue during device shutdown to ensure that all pending work items are completed before the driver is unloaded. Note: This approach may slightly increase shutdown latency if the workqueue contains jobs from other devices, but it ensures correctness and stability.
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: e5745f34113b758b45d134dec04a7df94dc67131 , < fa4c14a82747886d333d8baef0d26da86ba1ccf7 (git)
Affected: e5745f34113b758b45d134dec04a7df94dc67131 , < 5858448a6c65d8ee3f8600570d3ce19febcb33be (git)
Affected: e5745f34113b758b45d134dec04a7df94dc67131 , < fe546f5c50fc474daca6bee72caa7ab68a74c33d (git)
Affected: e5745f34113b758b45d134dec04a7df94dc67131 , < e59a52e429e13df3feb34f4853a8e36d121ed937 (git)
Affected: e5745f34113b758b45d134dec04a7df94dc67131 , < 3d4df408ba9bad2b205c7fb8afc1836a6a4ca88a (git)
Create a notification for this product.
Linux Linux Affected: 5.18
Unaffected: 0 , < 5.18 (semver)
Unaffected: 6.1.162 , ≤ 6.1.* (semver)
Unaffected: 6.6.103 , ≤ 6.6.* (semver)
Unaffected: 6.12.44 , ≤ 6.12.* (semver)
Unaffected: 6.16.4 , ≤ 6.16.* (semver)
Unaffected: 6.17 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/crypto/intel/qat/qat_common/adf_common_drv.h",
            "drivers/crypto/intel/qat/qat_common/adf_init.c",
            "drivers/crypto/intel/qat/qat_common/adf_isr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "fa4c14a82747886d333d8baef0d26da86ba1ccf7",
              "status": "affected",
              "version": "e5745f34113b758b45d134dec04a7df94dc67131",
              "versionType": "git"
            },
            {
              "lessThan": "5858448a6c65d8ee3f8600570d3ce19febcb33be",
              "status": "affected",
              "version": "e5745f34113b758b45d134dec04a7df94dc67131",
              "versionType": "git"
            },
            {
              "lessThan": "fe546f5c50fc474daca6bee72caa7ab68a74c33d",
              "status": "affected",
              "version": "e5745f34113b758b45d134dec04a7df94dc67131",
              "versionType": "git"
            },
            {
              "lessThan": "e59a52e429e13df3feb34f4853a8e36d121ed937",
              "status": "affected",
              "version": "e5745f34113b758b45d134dec04a7df94dc67131",
              "versionType": "git"
            },
            {
              "lessThan": "3d4df408ba9bad2b205c7fb8afc1836a6a4ca88a",
              "status": "affected",
              "version": "e5745f34113b758b45d134dec04a7df94dc67131",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/crypto/intel/qat/qat_common/adf_common_drv.h",
            "drivers/crypto/intel/qat/qat_common/adf_init.c",
            "drivers/crypto/intel/qat/qat_common/adf_isr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.18"
            },
            {
              "lessThan": "5.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.162",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.162",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.103",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.44",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.4",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: qat - flush misc workqueue during device shutdown\n\nRepeated loading and unloading of a device specific QAT driver, for\nexample qat_4xxx, in a tight loop can lead to a crash due to a\nuse-after-free scenario. This occurs when a power management (PM)\ninterrupt triggers just before the device-specific driver (e.g.,\nqat_4xxx.ko) is unloaded, while the core driver (intel_qat.ko) remains\nloaded.\n\nSince the driver uses a shared workqueue (`qat_misc_wq`) across all\ndevices and owned by intel_qat.ko, a deferred routine from the\ndevice-specific driver may still be pending in the queue. If this\nroutine executes after the driver is unloaded, it can dereference freed\nmemory, resulting in a page fault and kernel crash like the following:\n\n    BUG: unable to handle page fault for address: ffa000002e50a01c\n    #PF: supervisor read access in kernel mode\n    RIP: 0010:pm_bh_handler+0x1d2/0x250 [intel_qat]\n    Call Trace:\n      pm_bh_handler+0x1d2/0x250 [intel_qat]\n      process_one_work+0x171/0x340\n      worker_thread+0x277/0x3a0\n      kthread+0xf0/0x120\n      ret_from_fork+0x2d/0x50\n\nTo prevent this, flush the misc workqueue during device shutdown to\nensure that all pending work items are completed before the driver is\nunloaded.\n\nNote: This approach may slightly increase shutdown latency if the\nworkqueue contains jobs from other devices, but it ensures correctness\nand stability."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:34:58.636Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/fa4c14a82747886d333d8baef0d26da86ba1ccf7"
        },
        {
          "url": "https://git.kernel.org/stable/c/5858448a6c65d8ee3f8600570d3ce19febcb33be"
        },
        {
          "url": "https://git.kernel.org/stable/c/fe546f5c50fc474daca6bee72caa7ab68a74c33d"
        },
        {
          "url": "https://git.kernel.org/stable/c/e59a52e429e13df3feb34f4853a8e36d121ed937"
        },
        {
          "url": "https://git.kernel.org/stable/c/3d4df408ba9bad2b205c7fb8afc1836a6a4ca88a"
        }
      ],
      "title": "crypto: qat - flush misc workqueue during device shutdown",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39721",
    "datePublished": "2025-09-05T17:21:28.911Z",
    "dateReserved": "2025-04-16T07:20:57.117Z",
    "dateUpdated": "2026-05-11T21:34:58.636Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-39721",
      "date": "2026-05-27",
      "epss": "0.00033",
      "percentile": "0.09969"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-39721\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-09-05T18:15:49.770\",\"lastModified\":\"2026-03-17T16:27:56.953\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ncrypto: qat - flush misc workqueue during device shutdown\\n\\nRepeated loading and unloading of a device specific QAT driver, for\\nexample qat_4xxx, in a tight loop can lead to a crash due to a\\nuse-after-free scenario. This occurs when a power management (PM)\\ninterrupt triggers just before the device-specific driver (e.g.,\\nqat_4xxx.ko) is unloaded, while the core driver (intel_qat.ko) remains\\nloaded.\\n\\nSince the driver uses a shared workqueue (`qat_misc_wq`) across all\\ndevices and owned by intel_qat.ko, a deferred routine from the\\ndevice-specific driver may still be pending in the queue. If this\\nroutine executes after the driver is unloaded, it can dereference freed\\nmemory, resulting in a page fault and kernel crash like the following:\\n\\n    BUG: unable to handle page fault for address: ffa000002e50a01c\\n    #PF: supervisor read access in kernel mode\\n    RIP: 0010:pm_bh_handler+0x1d2/0x250 [intel_qat]\\n    Call Trace:\\n      pm_bh_handler+0x1d2/0x250 [intel_qat]\\n      process_one_work+0x171/0x340\\n      worker_thread+0x277/0x3a0\\n      kthread+0xf0/0x120\\n      ret_from_fork+0x2d/0x50\\n\\nTo prevent this, flush the misc workqueue during device shutdown to\\nensure that all pending work items are completed before the driver is\\nunloaded.\\n\\nNote: This approach may slightly increase shutdown latency if the\\nworkqueue contains jobs from other devices, but it ensures correctness\\nand stability.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.18\",\"versionEndExcluding\":\"6.6.103\",\"matchCriteriaId\":\"1FC8F66F-9CC2-473F-94EC-4A539C92D9D7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.44\",\"matchCriteriaId\":\"12351F24-1133-4775-960C-F2B47E81298B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.16.4\",\"matchCriteriaId\":\"AFC28995-B8C3-4B68-8CB6-78E792B6629D\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/3d4df408ba9bad2b205c7fb8afc1836a6a4ca88a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5858448a6c65d8ee3f8600570d3ce19febcb33be\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e59a52e429e13df3feb34f4853a8e36d121ed937\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/fa4c14a82747886d333d8baef0d26da86ba1ccf7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/fe546f5c50fc474daca6bee72caa7ab68a74c33d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.