Description
In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Completely fix fcport double free

In qla24xx_els_dcmd_iocb() sp->free is set to qla2x00_els_dcmd_sp_free().
When an error happens, this function is called by qla2x00_sp_release(),
when kref_put() releases the first and the last reference.

qla2x00_els_dcmd_sp_free() frees fcport by calling qla2x00_free_fcport().
Doing it one more time after kref_put() is a bad idea.
Published: 2026-05-08
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The Linux kernel’s qla2xxx SCSI driver contains a double free bug (CWE-1341) that releases an fcport resource twice when an error occurs during command processing, which can corrupt kernel memory and trigger a kernel panic, effectively denying service to the system.

Affected Systems

Systems running Linux kernel versions that include the qla2xxx driver before the fix commit (c0b7da13a04bd70ef6070bfb9ea85f582294560a) are vulnerable. The driver manages Fibre Channel adapters; therefore any host deploying that driver prior to the patch is impacted.

Risk and Exploitability

The CVSS score of 9.8 marks the issue as critical. The EPSS score of less than 1% indicates a low current probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector involves triggering an error path in the driver that causes a double free; however, the exact method of exploitation is not specified in the provided data and therefore remains inferred.

Generated by OpenCVE AI on May 11, 2026 at 09:37 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Linux kernel patch that includes commit c0b7da13a04bd70ef6070bfb9ea85f582294560a, which fixes the fcport double free in the qla2xxx driver
  • Upgrade the system to a kernel version that incorporates the qla2xxx double free fix, such as the latest stable release or a vendor‑issued update
  • Repeat the patch or upgrade when new kernel releases become available to ensure the driver code no longer contains the double free path

Generated by OpenCVE AI on May 11, 2026 at 09:37 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 11 May 2026 07:45:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

 cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Sat, 09 May 2026 04:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416

Sat, 09 May 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-1341
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate

Fri, 08 May 2026 17:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416

Fri, 08 May 2026 14:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Completely fix fcport double free In qla24xx_els_dcmd_iocb() sp->free is set to qla2x00_els_dcmd_sp_free(). When an error happens, this function is called by qla2x00_sp_release(), when kref_put() releases the first and the last reference. qla2x00_els_dcmd_sp_free() frees fcport by calling qla2x00_free_fcport(). Doing it one more time after kref_put() is a bad idea.
Title scsi: qla2xxx: Completely fix fcport double free
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-05-23T16:06:56.357Z

Reserved: 2026-05-01T14:12:56.008Z

Link: CVE-2026-43414

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-05-08T15:16:53.353

Modified: 2026-05-12T14:10:27.343

Link: CVE-2026-43414

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-05-08T00:00:00Z

Links: CVE-2026-43414 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-05-11T09:45:07Z

Weaknesses