CVE-2026-43414: scsi: qla2xxx: Completely fix fcport double free
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Completely fix fcport double free
In qla24xxelsdcmdiocb() sp->free is set to qla2x00elsdcmdspfree(). When an error happens, this function is called by qla2x00sprelease(), when krefput() releases the first and the last reference.
qla2x00elsdcmdspfree() frees fcport by calling qla2x00freefcport(). Doing it one more time after krefput() is a bad idea.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.262-1Fixed in 7.1.8-1Fixed in 7.1.8-2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43414?
CVE-2026-43414 has a critical severity rating of 9.8.
How do I fix CVE-2026-43414?
To fix CVE-2026-43414, ensure that your Linux kernel and qla2xxx SCSI driver are updated to the latest patched version.
What causes the CVE-2026-43414 vulnerability?
CVE-2026-43414 is caused by a double free issue in the Linux kernel's qla2xxx SCSI driver.
Which systems are affected by CVE-2026-43414?
Systems running vulnerable versions of the Linux kernel and specifically the qla2xxx SCSI driver are affected by CVE-2026-43414.
What is the impact of CVE-2026-43414?
The impact of CVE-2026-43414 includes potential denial of service and arbitrary code execution due to the double free vulnerability.