scsi: qla2xxx: Completely fix fcport double free
CVE-2026-43414 · published 8 May 2026
How serious is it
- Severity: critical, CVSS score 9.8 out of 10.
- No exploit prediction (EPSS) score yet.
- Not on the CISA list of exploited vulnerabilities.
- No public exploit in Exploit-DB.
Is your app affected by CVE-2026-43414?
Paste this prompt into Claude Code, Cursor or any AI coding tool: it runs a free Shippable scan of your project and fixes what it finds. Built with Lovable, Bolt or v0? Scan your live app. Or upload your package file.
Who is affected
- Linux Linux: ef23850940d9a52c39936d27254824ccf5e9b6bd to < baabbd29191514391ca81594e43261bd17c6795a, 4895009c4bb72f71f2e682f1e7d2c2d96e482087 to < 7172f41786dc08144da4627483e405de57bf8d2c, 4895009c4bb72f71f2e682f1e7d2c2d96e482087 to < 4097a2afe8acc6038b71aab825430f1403decf20, 4895009c4bb72f71f2e682f1e7d2c2d96e482087 to < d48ea85463f5b34f7b92ea0a13eddf1ab993da7b
- Linux Linux: 6.9
How to check
- Find out whether you run the affected product and which version, then compare it with the versions above.
How to fix
Copies a prompt for Claude Code, Cursor or Codex that asks it to check whether you run this product.
- Apply the vendor's update or mitigation from the references below. If there is none yet, limit exposure of the affected service until there is.
- If a vulnerable version was live, check your logs and rotate the secrets that server could read.
The advisory
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Completely fix fcport double free
In qla24xx_els_dcmd_iocb() sp->free is set to qla2x00_els_dcmd_sp_free().
When an error happens, this function is called by qla2x00_sp_release(),
when kref_put() releases the first and the last reference.
qla2x00_els_dcmd_sp_free() frees fcport by calling qla2x00_free_fcport().
Doing it one more time after kref_put() is a bad idea.
Check your whole app
Dependencies are only half of it. Free and read-only: before you push, run npx shippable-dev scan localhost:3000 in your project folder, no account needed. For your live app, you prove it's yours with a one-line tag first.
References
- git.kernel.org/stable/c/baabbd29191514391ca81594e43261bd17c6795a
- git.kernel.org/stable/c/7172f41786dc08144da4627483e405de57bf8d2c
- git.kernel.org/stable/c/4097a2afe8acc6038b71aab825430f1403decf20
- git.kernel.org/stable/c/d48ea85463f5b34f7b92ea0a13eddf1ab993da7b
- git.kernel.org/stable/c/c0b7da13a04bd70ef6070bfb9ea85f582294560a
Merged from CVE List. Last updated 25 Oct 2026. All vulnerabilities · RSS · JSON