CVE-2024-26930: scsi: qla2xxx: Fix double free of the ha->vp_map pointer
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Fix double free of the ha->vpmap pointer
Coverity scan reported potential risk of double free of the pointer ha->vpmap. ha->vpmap was freed in qla2x00memalloc(), and again freed in function qla2x00memfree(ha).
Assign NULL to vpmap and kfree take care of NULL.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Fix double free of the ha->vpmap pointer
The Linux kernel CVE team has assigned CVE-2024-26930 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024050122-CVE-2024-26930-4f3e@gregkh/T
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.6.24 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.7.12 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.8.3 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.9 - Upgrade
Upgrade
Linux kernel scsi/qla2xxxto a version that resolves this vulnerability.Patch CVE-2024-26930
Event History
Frequently Asked Questions
What is the severity of CVE-2024-26930?
CVE-2024-26930 has been classified as a moderate severity vulnerability due to potential implications from a double free error in the Linux kernel.
How do I fix CVE-2024-26930?
To remediate CVE-2024-26930, upgrade your Linux kernel to versions 6.6.24, 6.7.12, 6.8.3, or 6.9 and ensure you apply the latest patches available for your distribution.
What software is affected by CVE-2024-26930?
CVE-2024-26930 affects various versions of the Linux kernel, specifically versions prior to 6.6.24, between 6.7 and 6.7.12, between 6.8 and 6.8.3, and 6.9-rc1.
What are the potential risks associated with CVE-2024-26930?
The potential risks of CVE-2024-26930 include system instability and possible remote code execution if exploited, due to improper management of memory resources.
Is CVE-2024-26930 specific to any Linux distribution?
CVE-2024-26930 is not limited to a specific Linux distribution and can impact various distributions that utilize the affected versions of the Linux kernel.