Executive brief
A vulnerability was identified in the Linux kernel's QLogic FastLinQ 4xxxx (qed) network driver. Under specific conditions where memory allocation fails during device setup, the system may attempt to release the same memory twice. This could lead to a system crash or instability, potentially impacting the availability of servers using this specific networking hardware.
Technical details
A double free vulnerability exists in the 'qed' driver within the Linux kernel. The issue resides in qed_cxt_tables_alloc(), where a failure in PF or VF CID bitmap allocations triggers a jump to an error handling label (cid_map_fail) that frees previously allocated bitmaps. Subsequently, the function calls qed_cxt_mngr_free(), which invokes qed_cid_map_free(), leading to a second free operation on the same pointers. The fix involves setting the CID bitmap pointers to NULL immediately after the first free to prevent subsequent deallocation attempts. This vulnerability was identified via static analysis and requires specific hardware configurations to trigger the failing allocation path.
Affected products
- Linux Linux Kernel v6.13-rc1 to v7.1-rc3
Timeline
- 2026-05-20: disclosed: Initial patch submission by Dawei Feng
- 2026-05-21: patched: Patch committed to mainline kernel
- 2026-07-19: advisory: CVE-2026-64118 published
References
- https://git.kernel.org/stable/c/06fa8e69019fd3c41a7b0ea8c5f509c3a33dc227
- https://git.kernel.org/stable/c/0e47fc1c9181ae029e0e35a865cbf2adcbae626c
- https://git.kernel.org/stable/c/2bccfb8476ca5f3548afbd623dc7a6980d4e77de
- https://git.kernel.org/stable/c/3904b993cc17ec5d7c5d3b57dbd0b775dafb9684
- https://git.kernel.org/stable/c/8cf5e4d2ca6b101d163c7423a426fb0aec34f7bb
- https://git.kernel.org/stable/c/9fe030719bd083b766602692ee96c8c985798e3c
- https://git.kernel.org/stable/c/a04c207f0801abdd23a169b5f902a9845059a65a