CVE-2026-64529: crypto: qat - remove unused character device and IOCTLs

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

crypto: qat - remove unused character device and IOCTLs

The QAT driver exposes a character device (qat_adf_ctl) with IOCTLs
for device configuration, start, stop, status query and enumeration.
These IOCTLs are not part of any public uAPI header and have no known
in-tree or out-of-tree users. Device lifecycle is already managed via
sysfs.

The ioctl interface also increases the attack surface and is the
subject of a number of bug reports.

Remove the character device, the IOCTL definitions, and the related
data structures (adf_dev_status_info, adf_user_cfg_key_val,
adf_user_cfg_section, adf_user_cfg_ctl_data). Drop the now-unused
adf_cfg_user.h header and strip adf_ctl_drv.c down to the minimal
module_init/module_exit hooks for workqueue, AER, and crypto/compression
algorithm registration.

Clean up leftover dead code that was only reachable from the removed
IOCTL paths: adf_cfg_del_all(), adf_devmgr_verify_id(),
adf_devmgr_get_num_dev(), adf_devmgr_get_dev_by_id(),
adf_get_vf_real_id() and the unused ADF_CFG macros.

Additionally, drop the entry associated to QAT IOCTLs in
ioctl-number.rst.

The Linux kernel CVE team has assigned CVE-2026-64529 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 3.17 with commit d8cba25d2c68992a6e7c1d329b690a9ebe01167d and fixed in 5.10.260 with commit 071590a44cbc38483fceb1ab943363ec26868e1b
	Issue introduced in 3.17 with commit d8cba25d2c68992a6e7c1d329b690a9ebe01167d and fixed in 5.15.211 with commit 1de076f43e64bf65fbe7280a269c70e0e60518df
	Issue introduced in 3.17 with commit d8cba25d2c68992a6e7c1d329b690a9ebe01167d and fixed in 6.1.177 with commit a4999664a5ef77bdb0c6e6b935f581ac8ce6b63a
	Issue introduced in 3.17 with commit d8cba25d2c68992a6e7c1d329b690a9ebe01167d and fixed in 6.6.144 with commit 6848a6e39cac44fdb7cb88f0f777df62172d1551
	Issue introduced in 3.17 with commit d8cba25d2c68992a6e7c1d329b690a9ebe01167d and fixed in 6.12.95 with commit b1ea97076bd0a5196290deba172034e480646727
	Issue introduced in 3.17 with commit d8cba25d2c68992a6e7c1d329b690a9ebe01167d and fixed in 6.18.37 with commit b8ebf008696de1ec08c90d51f94d7e40bd448be1
	Issue introduced in 3.17 with commit d8cba25d2c68992a6e7c1d329b690a9ebe01167d and fixed in 7.0.14 with commit de2cc38489b629927910b1aeff69bba7bd5c6f1b
	Issue introduced in 3.17 with commit d8cba25d2c68992a6e7c1d329b690a9ebe01167d and fixed in 7.1.2 with commit 3ae49dd04dbb11fb73f17f58a982dba128abe83a
	Issue introduced in 3.17 with commit d8cba25d2c68992a6e7c1d329b690a9ebe01167d and fixed in 7.2-rc1 with commit d237230728c567297f2f98b425d63156ab2ed17f

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64529
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	Documentation/userspace-api/ioctl/ioctl-number.rst
	drivers/crypto/intel/qat/qat_common/adf_cfg.c
	drivers/crypto/intel/qat/qat_common/adf_cfg.h
	drivers/crypto/intel/qat/qat_common/adf_cfg_common.h
	drivers/crypto/intel/qat/qat_common/adf_cfg_user.h
	drivers/crypto/intel/qat/qat_common/adf_common_drv.h
	drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c
	drivers/crypto/intel/qat/qat_common/adf_dev_mgr.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/071590a44cbc38483fceb1ab943363ec26868e1b
	https://git.kernel.org/stable/c/1de076f43e64bf65fbe7280a269c70e0e60518df
	https://git.kernel.org/stable/c/a4999664a5ef77bdb0c6e6b935f581ac8ce6b63a
	https://git.kernel.org/stable/c/6848a6e39cac44fdb7cb88f0f777df62172d1551
	https://git.kernel.org/stable/c/b1ea97076bd0a5196290deba172034e480646727
	https://git.kernel.org/stable/c/b8ebf008696de1ec08c90d51f94d7e40bd448be1
	https://git.kernel.org/stable/c/de2cc38489b629927910b1aeff69bba7bd5c6f1b
	https://git.kernel.org/stable/c/3ae49dd04dbb11fb73f17f58a982dba128abe83a
	https://git.kernel.org/stable/c/d237230728c567297f2f98b425d63156ab2ed17f