CVE-2025-39721

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

crypto: qat - flush misc workqueue during device shutdown

Repeated loading and unloading of a device specific QAT driver, for

example qat_4xxx, in a tight loop can lead to a crash due to a

use-after-free scenario. This occurs when a power management (PM)

interrupt triggers just before the device-specific driver (e.g.,

qat_4xxx.ko) is unloaded, while the core driver (intel_qat.ko) remains

loaded.

Since the driver uses a shared workqueue (`qat_misc_wq`) across all

devices and owned by intel_qat.ko, a deferred routine from the

device-specific driver may still be pending in the queue. If this

routine executes after the driver is unloaded, it can dereference freed

memory, resulting in a page fault and kernel crash like the following:

BUG: unable to handle page fault for address: ffa000002e50a01c

#PF: supervisor read access in kernel mode

RIP: 0010:pm_bh_handler+0x1d2/0x250 [intel_qat]

Call Trace:

p

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References