Linux kernel qla2xxx: fcport double free on the ELS DCMD error path

Impact

qla24xx_els_dcmd_iocb() freed the fcport structure a second time after kref_put() had already dropped the last reference and qla2x00_els_dcmd_sp_free() released it. The result is a double free in the QLogic Fibre Channel HBA driver, reached when an ELS command errors out. For operators this is a host-side storage driver: nodes with QLogic FC HBAs attached to SAN-backed scratch or dataset volumes can crash or corrupt kernel memory during FC error handling, and FC error handling is exactly what happens during fabric flaps. The record is a kernel commit with no exploit detail, so treat it as a stability and memory-corruption bug rather than a demonstrated privilege escalation.

Who can reach it

Local to the host and not tenant-reachable: triggered by error paths in the qla2xxx driver handling Fibre Channel ELS commands. Requires QLogic FC hardware with the driver loaded; conditions originate on the FC fabric, not from a GPU pod.

What to do

Apply a stable kernel carrying the fix (commits in the record) and reboot the affected hosts; drain each node first since the FC HBA driver cannot be reloaded under live storage. Nodes without qla2xxx hardware need no action.

References

Related entries

• Linux kernel mlx5_core RX datapath (striding RQ, page_pool): A regression introduced by the fix for CVE-2025-40350CVE-2026-43465 · Linux kernel mlx5_core RX datapath (striding RQ, page_pool)Critical
• Linux kernel pcrypt: EBUSY from backlogged requests is mishandled, corrupting completion accountingCVE-2026-43493 · Linux kernel crypto/pcrypt (MAY_BACKLOG request completion handling)Critical
• Linux kernel nvmet-tcp - ICReq/teardown race and data-digest error paths: Three lifecycle bugs an initiator can driveCVE-2026-46135 · Linux kernel nvmet-tcp - ICReq/teardown race and data-digest error pathsCritical
• Linux kernel libceph: out-of-bounds access parsing a CRUSH map with mismatched bucket algorithm fieldsCVE-2026-52955 · Linux kernel libceph (crush_decode bucket algorithm parsing)Critical
• Linux kernel (net/rds): If RDS/IB queue-pair setup fails after the send ring is allocated but before the receive ringCVE-2026-53355 · Linux kernel (net/rds)Critical
• Linux kernel (net/xfrm): IPTFS fragment consumption loses the shared-page marker, so ESP concludes the payload pagesCVE-2026-53363 · Linux kernel (net/xfrm)Critical