CVE-2026-43414
critical · 9.8In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Completely fix fcport double free In qla24xx_els_dcmd_iocb() sp->free is set to qla2x00_els_dcmd_sp_free(). When an error happens, this function is called by qla2x00_sp_release(), when kref_put() releases the first and the last reference. qla2x00_els_dcmd_sp_free() frees fcport by calling qla2x00_free_fcport(). Doing it one more time after kref_put() is a bad idea.
9.8
CVSS
0.4%
EPSS (exploit prob.)
32nd
EPSS percentile
2026-05-08
Published
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-415
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| linux | linux_kernel | >= 5.15.154, < 5.16 |
| linux | linux_kernel | >= 6.1.84, < 6.2 |
| linux | linux_kernel | >= 6.6.24, < 6.7 |
| linux | linux_kernel | >= 6.7.12, < 6.8 |
| linux | linux_kernel | >= 6.8.3, < 6.9 |
| linux | linux_kernel | >= 6.9.1, < 6.19.9 |
| linux | linux_kernel | 6.9 |
| linux | linux_kernel | 6.9 |
| linux | linux_kernel | 6.9 |
| linux | linux_kernel | 6.9 |
| linux | linux_kernel | 6.9 |
| linux | linux_kernel | 6.9 |
| linux | linux_kernel | 6.9 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
Check a specific version with /api/v1/cve/match.
References
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2026-43414