PT-2026-39075 · Linux · Linux Kernel

Published 2026-05-08 · Updated 2026-05-08 · CVE-2026-43414

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A double free issue exists in the scsi qla2xxx driver. In the qla24xx els dcmd iocb() function, sp->free is assigned to qla2x00 els dcmd sp free(). When an error occurs, this function is triggered by qla2x00 sp release() during the release of the first and last reference via kref put(). Because qla2x00 els dcmd sp free() calls qla2x00 free fcport(), a subsequent call after kref put() results in the fcport being freed twice.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2026-43414

Affected Products

Linux Kernel

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-43414 · Security Note
• https://git.kernel.org/stable/c/d48ea85463f5b34f7b92ea0a13eddf1ab993da7b · Note
• https://twitter.com/CVEnew/status/2052767663420854610 · Twitter Post
• https://git.kernel.org/stable/c/c0b7da13a04bd70ef6070bfb9ea85f582294560a · Note