Critical · published May 8, 2026
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Completely fix fcport double free
In qla24xx_els_dcmd_iocb() sp->free is set to qla2x00_els_dcmd_sp_free().
When an error happens, this function is called by qla2x00_sp_release(),
when kref_put() releases the first and the last reference.
qla2x00_els_dcmd_sp_free() frees fcport by calling qla2x00_free_fcport().
Doing it one more time after kref_put() is a bad idea.
| Product | Versions | Fixed in |
|---|---|---|
| linux/linux_kernel | ≥ 5.15.154, < 5.16 | 5.16 |
| linux/linux_kernel | ≥ 6.1.84, < 6.2 | 6.2 |
| linux/linux_kernel | ≥ 6.6.24, < 6.7 | 6.7 |
| linux/linux_kernel | ≥ 6.7.12, < 6.8 | 6.8 |
| linux/linux_kernel | ≥ 6.8.3, < 6.9 | 6.9 |
| linux/linux_kernel | ≥ 6.9.1, < 6.19.9 | 6.19.9 |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |