CVE-2026-43414

A flaw was found in the Linux kernel's qla2xxx SCSI driver. An issue exists where a Fibre Channel port (fcport) object can be freed twice due to an error in the qla2x00_els_dcmd_sp_free() function. This double free vulnerability can lead to memory corruption, potentially causing system instability or a denial of service.

This vulnerability is rated as Moderate severity because exploitation requires local access on systems configured with specific QLogic Fibre Channel hardware, confining the blast radius to local denial of service or kernel memory corruption. In typical Red Hat Enterprise Linux environments, the qla2xxx driver is only initialized when corresponding host bus adapters are present. Systems without this storage hardware do not load the module and remain unaffected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.