Look up another CVE · open CVE-2026-74306 in the interactive tracker
CVE-2026-74306
vfio/qat: fix f_pos race in qat_vf_resume_write()
Published 2026-08-15 (2 months ago) by the Linux kernel CNA. Subsystem drivers/vfio. Debian urgency: unimportant.
What to do, per Debian release
Debian's own status for CVE-2026-74306 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | not affected | 6.1.190-1 | Nothing to do. bookworm never shipped the vulnerable code. |
| Debian 13trixie | fixed | 6.12.100-1 | Update the kernel and reboot. Fixed in 6.12.100-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.1.5-1 | Update the kernel and reboot. Fixed in 7.1.5-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.5-1 | Update the kernel and reboot. Fixed in 7.1.5-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
qat_vf_resume_write() checks filp->f_pos before taking migf->lock, but copies into the migration-state buffer after taking the lock and re-reading the shared file position. Two concurrent writers could therefore pass the bounds check with the old offset, then have the second writer copy after the first advanced f_pos, writing past the end of the migration-state buffer. Take migf->lock before doing the boundary checks.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
drivers/vfio/pci/qat/main.c
- What this is
- VFIO QAT PCI DRIVERMAINTAINERS section matched on drivers/vfio/pci/qat/ · kvm@vger.kernel.org · Supported
Check it on the machine
grep -wE 'CONFIG_QAT_VFIO_PCI|CONFIG_VFIO|CONFIG_VFIO_PCI_CORE' /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
Show whether Debian builds this, per release
Debian does not build this code in 3 releases. The build rule could not be established for 1 release, so nothing is claimed about those.
- bookworm?
- trixie, forky, sidn
- ?
- not established - no Makefile entry for the affected file
- n
- not enabled on any flavour - this release does not build the code
Where a release above reads "not established", no build rule for the affected file was found in that release's kernel tree. That is a gap in this lookup, not a finding that the code is absent.
- Build switches
- CONFIG_QAT_VFIO_PCI, CONFIG_VFIO, CONFIG_VFIO_PCI_CORE
- Reads as
- all on means the file is compiled; any one off means it is not.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-08-15 (2 months ago)source
- CVSS
- 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.18%, higher than 6.5% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- unimportantsource
- Subsystem
- drivers/vfio
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 6.10 | 6.12.97 | 6465af0004dc |
| 6.10 | 6.18.40 | d416dcefdbac |
| 6.10 | 7.1.5 | b6fd7a40a664 |
| 6.10 | 7.2 | 4ec5e932e636 |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- Exploitation requires local write() syscalls on a VFIO live-migration resume fd returned by VFIO_DEVICE_FEATURE_MIG_DEVICE_STATE ioctl on an opened QAT VFIO PCI device; there is no network, adjacent-wireless, or physical-device attack path to this code.
- AC:LAttack complexity, low
- An attacker with the migration fd controls both racing writers (e.g., concurrent threads or dup'd fds sharing f_pos) and can repeatedly trigger the TOCTOU window near the buffer end until the overflow succeeds; no uncontrollable victim timing or memory layout is required.
- PR:LPrivileges required, low
- Exploitation requires only local access to an assigned Intel QAT VFIO device migration fd (typical QEMU/cloud/HPC VFIO clients), not real root in the init namespace; capabilities like CAP_NET_ADMIN via user namespaces do not grant this path.
- UI:NUser interaction, none
- No victim interaction is required; the attacker drives VFIO migration state transitions and concurrent writes to the resume fd programmatically without any separate user or administrator action during exploitation.
- S:UScope, unchanged
- The flaw corrupts host kernel heap memory from a VFIO client context and does not by itself cross an IOMMU, VM-guest, or other distinct security authority boundary; impact remains host kernel compromise/DoS within the same authority.
- C:HConfidentiality impact, high
- The race yields an attacker-controlled heap out-of-bounds write past the 4096-byte migration-state kmalloc buffer, which can corrupt adjacent kernel objects and be leveraged for arbitrary kernel memory disclosure, not merely a bounded leak.
- I:HIntegrity impact, high
- copy_from_user() writes attacker-controlled data beyond mig_dev->state, enabling heap corruption and potential arbitrary kernel write or code-execution primitives through grooming of adjacent kmalloc objects.
- A:HAvailability impact, high
- Heap corruption from the out-of-bounds write can immediately panic or oops the kernel or destabilize the system even when full exploitation is not attempted, satisfying high availability impact for kernel memory corruption.