CVE-2026-43414

In the qla24xx_els_dcmd_iocb() function, the sp->free pointer is set to qla2x00_els_dcmd_sp_free(). When an error occurs, this function is called by qla2x00_sp_release() at the moment when kref_put() releases the last reference to the object. The qla2x00_els_dcmd_sp_free() function frees the fcport structure by calling qla2x00_free_fcport(). The problem is that fcport is freed a second time after returning from kref_put(), which leads to a double free state and heap corruption.

An attacker can cause kernel memory corruption, which potentially enables arbitrary code execution (RCE), privilege escalation, or system destabilization (denial of service — kernel crash).

Patches available from the vendor should be applied according to references — fixes available in the Linux kernel stable repository at the addresses indicated in the references section (commit c0b7da13a04b and d48ea85463f5).

Versions indicated in vendor references (Linux kernel with SCSI qla2xxx driver)