← Back

CVE-2026-43414

nvd nist
Published: May 8, 2026Modified: Jul 8, 2026

JSON object

Loading...
9.8
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability: 3.9 / Impact: 5.9
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (Secondary)

Description

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Completely fix fcport double free In qla24xx_els_dcmd_iocb() sp->free is set to qla2x00_els_dcmd_sp_free(). When an error happens, this function is called by qla2x00_sp_release(), when kref_put() releases the first and the last reference. qla2x00_els_dcmd_sp_free() frees fcport by calling qla2x00_free_fcport(). Doing it one more time after kref_put() is a bad idea.

Affected (16)

Products: Linux: Linux Kernel
Linux
1 product
Linux Kernel
Configuration A
16 vulnerable
Vulnerable SoftwareAffected Versions
Linux
Linux Kernel
From 5.15.154 to 5.16
Linux Kernel
From 6.1.84 to 6.2
Linux Kernel
From 6.6.24 to 6.7
Linux Kernel
From 6.7.12 to 6.8
Linux Kernel
From 6.8.3 to 6.9
Linux Kernel
From 6.9.1 to 6.19.9
Linux Kernel
Version 6.9
Linux Kernel
Version 6.9 rc2
Linux Kernel
Version 6.9 rc3
Linux Kernel
Version 6.9 rc4
Linux Kernel
Version 6.9 rc5
Linux Kernel
Version 6.9 rc6
Linux Kernel
Version 6.9 rc7
Linux Kernel
Version 7.0 rc1
Linux Kernel
Version 7.0 rc2
Linux Kernel
Version 7.0 rc3

Related CWEs

CWE-415
Double Free
The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.

References (2)

Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Patch

Timeline

No history available yet.