CVE-2025-35998
Published: 10 February 2026
Summary
CVE-2025-35998 is a high-severity Missing Protection Mechanism for Alternate Hardware Interface (CWE-1299) vulnerability in Intel (inferred from references). Its CVSS base score is 7.9 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 0.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-25 (Reference Monitor) and SC-41 (Port and I/O Device Access).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Implements a reference monitor protection mechanism that enforces access controls on the alternate hardware interface, directly addressing the missing protection in Intel QAT kernel.
Remediates the specific kernel flaw in Intel Quick Assist Technology via timely patching as advised in the Intel security advisory.
Restricts access to the vulnerable alternate hardware interface and I/O ports, preventing privileged user exploitation of the unprotected mechanism.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Kernel-level privilege escalation vulnerability directly matches T1068 Exploitation for Privilege Escalation.
NVD Description
Missing protection mechanism for alternate hardware interface in the Intel(R) Quick Assist Technology for some Intel(R) Platforms within Ring 0: Kernel may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexity attack…
more
may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present with special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
Deeper analysisAI
CVE-2025-35998 is a vulnerability involving a missing protection mechanism for an alternate hardware interface in the Intel(R) Quick Assist Technology for some Intel(R) Platforms, operating within Ring 0. This flaw in the kernel can allow escalation of privilege. It is classified under CWE-1299 and carries a CVSS v3.1 base score of 7.9 (AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N), indicating high severity due to impacts on confidentiality and integrity.
A system software adversary with privileged user access (PR:H) can exploit this vulnerability via local access (AV:L) using a low-complexity attack (AC:L) that requires no user interaction (UI:N) and special internal knowledge. The attack changes scope (S:C), potentially enabling escalation of privilege with high confidentiality (C:H) and integrity (I:H) impacts but no availability effects (A:N).
For mitigation details, refer to the Intel Security Advisory at https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01406.html.
Details
- CWE(s)