CVE-2026-43414: scsi: qla2xxx: Completely fix fcport double free
Vulnerability summary
CVE-2026-43414 is a critical (CVSS 9.8) Double Free vulnerability in linux. EPSS estimates a 0.60% chance of exploitation in the next 30 days, higher than 48.7% of scored vulnerabilities.
Severe, CVSS 9.8 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 1% (FIRST, 03-11-2026)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 46 · Related 49Timeline
- 08-05-2026PublishedVulnerability first disclosed.
- 30-10-2026Last modifiedVulnerability information updated.
Description
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Completely fix fcport double free In qla24xx_els_dcmd_iocb() sp->free is set to qla2x00_els_dcmd_sp_free(). When an error happens, this function is called by qla2x00_sp_release(), when kref_put() releases the first and the last reference. qla2x00_els_dcmd_sp_free() frees fcport by calling qla2x00_free_fcport(). Doing it one more time after kref_put() is a bad idea.
CVSS metrics
5 scores · 5 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · ChainguardEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- NVDNIST9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.60%
Chance of exploitation in the next 30 days
Percentile
49%
Versus all other CVEs
30-day change
Increase +0.05 pp
From 0.55% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu157 products
- linux< 4.4.0-283.317 | < 4.15.0-253.265 | < 5.4.0-233.253 | < 5.15.0-185.195 | < 6.8.0-134.134 | < 6.17.0-40.40
- linux-allwinner-5.19All versions (No fix recorded)
- linux-aws< 4.4.0-1156.162 | < 4.4.0-1194.209 | < 4.15.0-1194.207 | < 5.4.0-1161.172 | < 5.15.0-1111.118 | < 6.8.0-1060.63 | < 6.17.0-1019.19
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
Chainguard26 products
- linux-aws-6.12All versions (No fix recorded)
- linux-aws-6.18All versions (No fix recorded)
- linux-azure-6.12All versions (No fix recorded)
- linux-azure-6.18All versions (No fix recorded)
- linux-desktop-6.18All versions (No fix recorded)
Linux2 products
- linux≥ 3b9d72442adfbc9ddb0f76dd1b03977b3a578b16, < bb9c7eca6f8f2e4a1cd8ba6711e7efe9044c0327 | ≥ ef23850940d9a52c39936d27254824ccf5e9b6bd, < baabbd29191514391ca81594e43261bd17c6795a | ≥ 4895009c4bb72f71f2e682f1e7d2c2d96e482087, < 7172f41786dc08144da4627483e405de57bf8d2c | ≥ 4895009c4bb72f71f2e682f1e7d2c2d96e482087, < 4097a2afe8acc6038b71aab825430f1403decf20 | ≥ 4895009c4bb72f71f2e682f1e7d2c2d96e482087, < d48ea85463f5b34f7b92ea0a13eddf1ab993da7b | ≥ 4895009c4bb72f71f2e682f1e7d2c2d96e482087, < c0b7da13a04bd70ef6070bfb9ea85f582294560a | 7861213201838480dc222634c56fb6db113d010d | 6c6bf6cacf9461f8d301cfac4f9c175d80cbcc63 | cd10dee1f07a782f5aa05703c55299ca86a85ee4 | b03e626bd6d3f0684f56ee1890d70fc9ca991c04 | 282877633b25d67021a34169c5b5519b1d4ef65e | f85af9f1aa5e2f53694a6cbe72010f754b5ff862 | 9b43d2884b54d415caab48878b526dfe2ae9921b | 846fb9f112f618ec6ae181d8dae7961652574774 | ≥ 6.1.84, < 6.1.191 | ≥ 6.6.24, < 6.6.160 | ≥ 5.15.154, < 5.16 | ≥ 6.7.12, < 6.8 | ≥ 6.8.3, < 6.9 | 6.9
- linux_kernelEOL≥ 5.15.154, < 5.16 | ≥ 6.1.84, < 6.2 | ≥ 6.6.24, < 6.7 | ≥ 6.7.12, < 6.8 | ≥ 6.8.3, < 6.9 | ≥ 6.9.1, < 6.19.9 | 6.9 | 6.9:rc2 | 6.9:rc3 | 6.9:rc4 | 6.9:rc5 | 6.9:rc6 | 6.9:rc7 | 7.0:rc1 | 7.0:rc2 | 7.0:rc3
Debian1 product
- linuxAll versions (No fix recorded) | < 6.12.115-2 | < 6.19.10-1
4 vendors · 186 products
