# CVE-2026-43414: Linux Kernel qla2xxx double free in qla24xx_els_dcmd_iocb

Source: https://junglewise.ai/threats/cve-2026-43414-linux-kernel-qla2xxx-double-free-in-qla24xx-els-dcmd-iocb  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-08. Updated: 2026-07-08  
License: CC BY 4.0 with a link back

CVE-2026-43414 · Severity: critical · CVSS 9.8 · Published 2026-05-08

A vulnerability exists in the Linux kernel's QLogic Fibre Channel driver, which manages high-speed storage connections. An error in how the system handles memory during certain failures could allow an attacker to cause a system crash or potentially execute unauthorized code. This could lead to a total loss of service availability or unauthorized access to data stored on the network.

Technologies: [Linux Kernel](https://junglewise.ai/threats/technologies/kernel). Vendors: [Linux](https://junglewise.ai/threats/vendors/linux).

## Quick answers

**Is CVE-2026-43414 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-43414 being exploited in the wild.

**How severe is CVE-2026-43414?** Critical severity, with a CVSS score of 9.8, published 8 May 2026.

**Which products and versions are affected?** Linux Kernel qla2xxx driver; Linux Kernel 5.15.154 to 5.16, 6.1.84 to 6.2, 6.6.24 to 6.7, 6.7.12 to 6.8, 6.8.3 to 6.9, 6.9.1 to 6.19.9.

**Is there a fix for CVE-2026-43414?** A patch was published on 2026-03-07: Initial patch committed to stable tree Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-43414 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2026-43414?** Check whether you run Linux Kernel or Linux Kernel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A double free vulnerability exists in the qla2xxx driver within the Linux kernel, specifically in the qla24xx_els_dcmd_iocb() function. The root cause is an incorrect reference counting implementation where qla2x00_free_fcport() is explicitly called after kref_put() has already triggered the same cleanup via qla2x00_sp_release(). This occurs during error handling paths when an ELS (Extended Link Service) command fails. An attacker could potentially exploit this memory corruption to cause a kernel panic (DoS) or achieve escalated privileges. Patches have been released for multiple stable kernel branches including 5.15.y, 6.1.y, 6.6.y, and 6.9.y.

## Affected products

- Linux Linux Kernel 5.15.154 to 5.16, 6.1.84 to 6.2, 6.6.24 to 6.7, 6.7.12 to 6.8, 6.8.3 to 6.9, 6.9.1 to 6.19.9

## Timeline

- 2026-05-08: disclosed
- 2026-03-07: patched: Initial patch committed to stable tree
- 2026-05-08: advisory

## References

- [https://git.kernel.org/stable/c/c0b7da13a04bd70ef6070bfb9ea85f582294560a](https://git.kernel.org/stable/c/c0b7da13a04bd70ef6070bfb9ea85f582294560a)
- [https://git.kernel.org/stable/c/d48ea85463f5b34f7b92ea0a13eddf1ab993da7b](https://git.kernel.org/stable/c/d48ea85463f5b34f7b92ea0a13eddf1ab993da7b)

## Related threats

- [Linux IOMMU page table logic error in arm_lpae_split_blk_unmap](https://junglewise.ai/threats/cve-2026-56934-in-arm-lpae-split-blk-unmap-of-drivers-iommu-io-pgtable-arm)
- [Linux kernel null pointer dereference in TCP established lookup](https://junglewise.ai/threats/cve-2026-99288-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel xen-netback double unmap memory corruption](https://junglewise.ai/threats/cve-2026-99287-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel xen-netback race condition in XenBus disconnect](https://junglewise.ai/threats/cve-2026-99286-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel shared-frag flag loss in skb_zerocopy](https://junglewise.ai/threats/cve-2026-99284-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)