Cyber Posture

CVE-2025-35998

High

Published: 10 February 2026

Published
10 February 2026
Modified
15 April 2026
KEV Added
Patch
CVSS Score 7.9 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
EPSS Score 0.0001 0.3th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-35998 is a high-severity Missing Protection Mechanism for Alternate Hardware Interface (CWE-1299) vulnerability in Intel (inferred from references). Its CVSS base score is 7.9 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 0.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-25 (Reference Monitor) and SC-41 (Port and I/O Device Access).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Privilege Escalation (T1068). What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Implements a reference monitor protection mechanism that enforces access controls on the alternate hardware interface, directly addressing the missing protection in Intel QAT kernel.

prevent

Remediates the specific kernel flaw in Intel Quick Assist Technology via timely patching as advised in the Intel security advisory.

prevent

Restricts access to the vulnerable alternate hardware interface and I/O ports, preventing privileged user exploitation of the unprotected mechanism.

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Why these techniques?

Kernel-level privilege escalation vulnerability directly matches T1068 Exploitation for Privilege Escalation.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Missing protection mechanism for alternate hardware interface in the Intel(R) Quick Assist Technology for some Intel(R) Platforms within Ring 0: Kernel may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexity attack…

more

may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present with special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

Deeper analysisAI

CVE-2025-35998 is a vulnerability involving a missing protection mechanism for an alternate hardware interface in the Intel(R) Quick Assist Technology for some Intel(R) Platforms, operating within Ring 0. This flaw in the kernel can allow escalation of privilege. It is classified under CWE-1299 and carries a CVSS v3.1 base score of 7.9 (AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N), indicating high severity due to impacts on confidentiality and integrity.

A system software adversary with privileged user access (PR:H) can exploit this vulnerability via local access (AV:L) using a low-complexity attack (AC:L) that requires no user interaction (UI:N) and special internal knowledge. The attack changes scope (S:C), potentially enabling escalation of privilege with high confidentiality (C:H) and integrity (I:H) impacts but no availability effects (A:N).

For mitigation details, refer to the Intel Security Advisory at https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01406.html.

Details

CWE(s)

Affected Products

Intel
inferred from references and description; NVD did not file a CPE for this CVE

References