Critical severity · published May 8, 2026
CVE-2026-43414
scsi: qla2xxx: Completely fix fcport double free
9.8
CVSS
0.6%
EPSS
No
On KEV
Description
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Completely fix fcport double free
In qla24xx_els_dcmd_iocb() sp->free is set to qla2x00_els_dcmd_sp_free().
When an error happens, this function is called by qla2x00_sp_release(),
when kref_put() releases the first and the last reference.
qla2x00_els_dcmd_sp_free() frees fcport by calling qla2x00_free_fcport().
Doing it one more time after kref_put() is a bad idea.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 46% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KE
Kernel · Linux
5.15.154 before 5.16; 6.1.84 before 6.2; 6.6.24 before 6.7; 6.7.12 before 6.8; 6.8.3 before 6.9; 6.9.1 before 6.19.9; +10 more · source: NVD
LI
Linux · Linux
ef23850940d9a52c39936d27254824ccf5e9b6bd before baabbd29191514391ca81594e43261bd17c6795a; 4895009c4bb72f71f2e682f1e7d2c2d96e482087 before 7172f41786dc08144da4627483e405de57bf8d2c; 4895009c4bb72f71f2e682f1e7d2c2d96e482087 before 4097a2afe8acc6038b71aab825430f1403decf20; 4895009c4bb72f71f2e682f1e7d2c2d96e482087 before d48ea85463f5b34f7b92ea0a13eddf1ab993da7b; 4895009c4bb72f71f2e682f1e7d2c2d96e482087 before c0b7da13a04bd70ef6070bfb9ea85f582294560a; 7861213201838480dc222634c56fb6db113d010d; +14 more · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-43414
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-43414
git.kernel.org
https://git.kernel.org/stable/c/4097a2afe8acc6038b71aab825430f1403decf20
git.kernel.org
https://git.kernel.org/stable/c/7172f41786dc08144da4627483e405de57bf8d2c
git.kernel.org
https://git.kernel.org/stable/c/baabbd29191514391ca81594e43261bd17c6795a
Patch
https://git.kernel.org/stable/c/c0b7da13a04bd70ef6070bfb9ea85f582294560a
Patch
https://git.kernel.org/stable/c/d48ea85463f5b34f7b92ea0a13eddf1ab993da7b
More from Kernel
9.8
CVE-2025-39682
tls: fix handling of zero-length records on the rx_list
8.8
CVE-2026-53266
netfilter: bridge: make ebt_snat ARP rewrite writable
8.8
CVE-2013-6282
Linux Kernel Improper Input Validation Vulnerability
8.4
CVE-2022-0185
Linux Kernel Heap-Based Buffer Overflow Vulnerability
8.4
CVE-2013-2094
Linux Kernel Privilege Escalation Vulnerability