SECUFOCUSNOW
Home›CVE index›CVE-2026-64529
Review reviewHigh

CVE-2026-64529

Linux

In the Linux kernel, the following vulnerability has been resolved: crypto: qat - remove unused character device and IOCTLs The QAT driver exposes a character device (qat_adf_ctl) with IOCTLs for device configuration, start, stop, status query and enumeration. These IOCTLs are not part of any public uAPI header and have no known in-tree or out-of-tree users. Device lifecycle is already managed via sysfs. The ioctl interface also increases the attack surface and is the subject of a number of bug reports. Remove the character device, the IOCTL definitions, and the related data structures (adf...

CVSS
7.8
EPSS
-
- percentile
CISA KEV
Not listed
Published
2026.07.25
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability-
Technical severityCVSS 7.8

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: crypto: qat - remove unused character device and IOCTLs The QAT driver exposes a character device (qat_adf_ctl) with IOCTLs for device configuration, start, stop, status query and enumeration. These IOCTLs are not part of any public uAPI header and have no known in-tree or out-of-tree users. Device lifecycle is already managed via sysfs. The ioctl interface also increases the attack surface and is the subject of a number of bug reports. Remove the character device, the IOCTL definitions, and the related data structures (adf...

Affected product and versions

Product
Linux
Affected versions
>= d8cba25d2c68992a6e7c1d329b690a9ebe01167d < 071590a44cbc38483fceb1ab943363ec26868e1b, >= d8cba25d2c68992a6e7c1d329b690a9ebe01167d < 1de076f43e64bf65fbe7280a269c70e0e60518df, >= d8cba25d2c68992a6e7c1d329b690a9ebe01167d < a4999664a5ef77bdb0c6e6b935f581ac8ce6b63a, >= d8cba25d2c68992a6e7c1d329b690a9ebe01167d < 6848a6e39cac44fdb7cb88f0f777df62172d1551, >= d8cba25d2c68992a6e7c1d329b690a9ebe01167d < b1ea97076bd0a5196290deba172034e480646727, >= d8cba25d2c68992a6e7c1d329b690a9ebe01167d < b8ebf008696de1ec08c90d51f94d7e40bd448be1, >= d8cba25d2c68992a6e7c1d329b690a9ebe01167d < de2cc38489b629927910b1aeff69bba7bd5c6f1b, >= d8cba25d2c68992a6e7c1d329b690a9ebe01167d < 3ae49dd04dbb11fb73f17f58a982dba128abe83a, >= d8cba25d2c68992a6e7c1d329b690a9ebe01167d < d237230728c567297f2f98b425d63156ab2ed17f, >= 3.17
Fixed versions
No verified fixed-version field is available yet

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that Linux and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
Not available