crypto: qat - flush misc workqueue during device shutdown

{
  "id": "fd31fab0b1e08883a6cc85546536afd592c6754ca74c7283609d46ea764c1bb6",
  "url": "https://osv.dev/vulnerability/CVE-2025-39721",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "crypto: qat - flush misc workqueue during device shutdown",
    "summary": "In the Linux kernel, the following vulnerability has been resolved: crypto: qat - flush misc workqueue during device shutdown Repeated loading and unloading of a device specific QAT driver, for example qat_4xxx, in a tight loop can lead to a crash due to a use-after-free scenario. This occurs when a power management (PM) interrupt triggers just before the device-specific driver (e.g., qat_4xxx.ko) is unloaded, while the core driver (intel_qat.ko) remains loaded. Since the driver uses a shared workqueue (`qat_misc_wq`) across all devices and owned by intel_qat.ko, a deferred routine from the device-specific driver may still be pending in the queue. If this routine executes after the driver is unloaded, it can dereference freed memory, resulting in a page fault and kernel crash like the following: BUG: unable to handle page fault for address: ffa000002e50a01c #PF: supervisor read access in kernel mode RIP: 0010:pm_bh_handler+0x1d2/0x250 [intel_qat] Call Trace: pm_bh_handler+0x1d2/0x250 [intel_qat] process_one_work+0x171/0x340 worker_thread+0x277/0x3a0 kthread+0xf0/0x120 ret_from_fork+0x2d/0x50 To prevent this, flush the misc workqueue during device shutdown to ensure that all pending work items are completed before the driver is unloaded. Note: This approach may slightly increase shutdown latency if the workqueue contains jobs from other devices, but it ensures correctness and stability.",
    "evidence": "osv:CVE-2025-39721",
    "products": [
      {
        "name": {
          "value": "Kernel",
          "evidence": "/affected/1/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "6.1.162",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.6.103",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.12.44",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.16.4",
            "evidence": "/affected/1/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "CVE-2025-39721",
      "aliases": [
        "CVE-2025-39721"
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "e5745f34113b758b45d134dec04a7df94dc67131"
                },
                {
                  "fixed": "fa4c14a82747886d333d8baef0d26da86ba1ccf7"
                },
                {
                  "fixed": "5858448a6c65d8ee3f8600570d3ce19febcb33be"
                },
                {
                  "fixed": "fe546f5c50fc474daca6bee72caa7ab68a74c33d"
                },
                {
                  "fixed": "e59a52e429e13df3feb34f4853a8e36d121ed937"
                },
                {
                  "fixed": "3d4df408ba9bad2b205c7fb8afc1836a6a4ca88a"
                }
              ]
            }
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-39721.json"
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "5.18.0"
                },
                {
                  "fixed": "6.1.162"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.2.0"
                },
                {
                  "fixed": "6.6.103"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.7.0"
                },
                {
                  "fixed": "6.12.44"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.13.0"
                },
                {
                  "fixed": "6.16.4"
                }
              ]
            }
          ],
          "package": {
            "name": "Kernel",
            "ecosystem": "Linux"
          },
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-39721.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:33.033955632Z",
      "provider": "osv",
      "references": [
        "https://cert-portal.siemens.com/productcert/html/ssa-019113.html",
        "https://cert-portal.siemens.com/productcert/html/ssa-457936.html",
        "https://git.kernel.org/stable/c/3d4df408ba9bad2b205c7fb8afc1836a6a4ca88a",
        "https://git.kernel.org/stable/c/5858448a6c65d8ee3f8600570d3ce19febcb33be",
        "https://git.kernel.org/stable/c/e59a52e429e13df3feb34f4853a8e36d121ed937",
        "https://git.kernel.org/stable/c/fa4c14a82747886d333d8baef0d26da86ba1ccf7",
        "https://git.kernel.org/stable/c/fe546f5c50fc474daca6bee72caa7ab68a74c33d",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/39xxx/CVE-2025-39721.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2025-39721",
        "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
      ],
      "provider_metadata": {
        "cna_assigner": "Linux",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/39xxx/CVE-2025-39721.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2025-39721",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 500208,
  "published_at": "2025-09-05T17:21:28.911+00:00"
}