CVE-2025-68741

In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Fix improper freeing of purex item

In qla2xxx_process_purls_iocb(), an item is allocated via qla27xx_copy_multiple_pkt(), which internally calls qla24xx_alloc_purex_item().

The qla24xx_alloc_purex_item() function may return a pre-allocated item from a per-adapter pool for small allocations, instead of dynamically allocating memory with kzalloc().

An error handling path in qla2xxx_process_purls_iocb() incorrectly uses kfree() to release the item. If the item was from the pre-allocated pool, calling kfree() on it is a bug that can lead to memory corruption.

Fix this by using the correct deallocation function, qla24xx_free_purex_item(), which properly handles both dynamically allocated and pre-allocated items.

This flaw is rated with a Moderate severity rather than Important because exploitation is constrained to environments utilizing specific QLogic Fibre Channel hardware and requires specific error conditions to trigger the improper deallocation. The vulnerability exists within the qla2xxx kernel driver, where mishandling of pool-allocated items during error handling can result in kernel memory corruption or a system crash. Systems lacking QLogic Fibre Channel Host Bus Adapters or where the qla2xxx module is not loaded are unaffected by this flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.