CVE-2026-43414 Details
Description
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Completely fix fcport double free In qla24xx_els_dcmd_iocb() sp->free is set to qla2x00_els_dcmd_sp_free(). When an error happens, this function is called by qla2x00_sp_release(), when kref_put() releases the first and the last reference. qla2x00_els_dcmd_sp_free() frees fcport by calling qla2x00_free_fcport(). Doing it one more time after kref_put() is a bad idea.
A vulnerability in the Linux kernel's SCSI QLA2XXX driver has been addressed, specifically related to improper management of Fibre Channel (FC) port references. In the function 'qla24xx_els_dcmd_iocb()', a pointer is incorrectly set to a free function that releases FC port resources. When an error occurs, this release function is called, potentially leading to a double free situation. The issue arises because the reference counting mechanism is not properly handled, allowing the same resource to be freed multiple times, which can lead to memory corruption.
Users can upgrade to the latest version of the Linux kernel where this vulnerability has been fixed. Instructions for upgrading the Linux kernel can be found in the official Linux kernel documentation.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/c0b7da13a04bd70ef6070bfb9ea85f582294560a | kernel.org | Patch |
| https://git.kernel.org/stable/c/d48ea85463f5b34f7b92ea0a13eddf1ab993da7b | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-415 | Double Free | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 5.15.154, < 5.16 >= 6.1.84, < 6.2 >= 6.6.24, < 6.7 >= 6.7.12, < 6.8 >= 6.8.3, < 6.9 >= 6.9.1, < 6.19.9 6.9 - 6.9 rc2 6.9 rc3 6.9 rc4 6.9 rc5 6.9 rc6 6.9 rc7 7.0 rc1 7.0 rc2 7.0 rc3 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 8, 2026 | Initial Analysis | [email protected] |
| Jun 17, 2026 | CVE Modified | kernel.org |
| May 11, 2026 | CVE Modified | kernel.org |
| May 8, 2026 | New CVE Received | kernel.org |