PT-2026-39075 · Linux · Linux Kernel

Published 2026-05-08 · Updated 2026-06-18 · CVE-2026-43414

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A double free issue exists in the scsi qla2xxx driver. In the qla24xx els dcmd iocb() function, sp->free is assigned to qla2x00 els dcmd sp free(). When an error occurs, this function is triggered by qla2x00 sp release() during the release of the first and last reference via kref put(). The qla2x00 els dcmd sp free() function frees the fcport by calling qla2x00 free fcport(), and performing this action again after kref put() leads to a double free.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2026-43414

SUSE-SU-2026:22048-1

SUSE-SU-2026:22076-1

SUSE-SU-2026:22087-1

SUSE-SU-2026:22108-1

SUSE-SU-2026:22137-1

SUSE-SU-2026:2450-1

Affected Products

Linux Kernel

References · 354

• https://osv.dev/vulnerability/SUSE-SU-2026:22137-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:22076-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:22087-1 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2026-43414 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-43414 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:22048-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:22108-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-43414 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-43414 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:2450-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-43414 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-UBUNTU-2204-CVE-2026-43414 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-43414 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-43414 · Vendor Advisory
• https://bugzilla.suse.com/1267663 · Note