Linux kernel qla2xxx: double free in bsg_done() on the Fibre Channel passthrough error path

Impact

Several routines in the qla2xxx Fibre Channel driver call bsg_done() on failure paths as well as on success, producing a double free. The report is a kernel panic on a ProLiant DL360 Gen11 taken while running a firmware update utility against the HBA, so the realistic trigger is management tooling on the storage path rather than a tenant workload. For an operator the exposure is a host crash on any node with QLogic FC HBAs - typically storage or metadata servers behind a GPU fleet rather than the GPU nodes themselves. Memory corruption is in kernel context, so a privilege-escalation ceiling cannot be ruled out, but the record only demonstrates a panic.

Who can reach it

Local with privilege: a process able to issue bsg passthrough requests to the FC HBA (/dev/bsg entries, normally root-only), for example vendor firmware or diagnostic utilities. Not reachable by an unprivileged tenant.

What to do

Take the stable kernel update carrying the qla2xxx bsg_done validation fix (commits in the record) and reboot the affected storage hosts. Until then, avoid running HBA firmware-update and vendor diagnostic utilities that drive the bsg passthrough path on production nodes. No fixed distribution version is named in the record.

References

Related entries

• OpenSSH ssh client: shell metacharacters in a command-line username allow injectionCVE-2026-106583 · OpenSSH ssh client (command-line username handling)High
• libvirt: integer overflow in NodeGetFreePages gives a local user heap corruption in the root daemonCVE-2026-18917 · libvirt (NodeGetFreePages RPC handler)High
• Linux KVM - irqfd routing type clobbered on deassign: Deassigning a KVM_IRQFD clobbers the irqfd's copy of theCVE-2026-23198 · Linux KVM - irqfd routing type clobbered on deassignHigh
• Linux kernel (net/xfrm): Closing an ESP-in-TCP socket cancels its transmit work item, but the write-space callback canCVE-2026-23239 · Linux kernel (net/xfrm)High
• Linux kernel perf: use-after-free on the perf ring buffer when mmap setup fails during a concurrent attachCVE-2026-23248 · Linux kernel perf/core (perf_mmap ring-buffer refcount)High
• Linux kernel perf: software events run the overflow path with IRQs enabled, racing teardown of the event's BPF programCVE-2026-23271 · Linux kernel perf (__perf_event_overflow vs perf_remove_from_context)High