Review reviewHigh

CVE-2024-26930

Linux Linux, linux kernel

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix double free of the ha->vp_map pointer Coverity scan reported potential risk of double free of the pointer ha->vp_map. ha->vp_map was freed in qla2x00_mem_alloc(), and again freed in function qla2x00_mem_free(ha). Assign NULL to vp_map and kfree take care of NULL.

CVSS: 7.8
EPSS: 0.23%
CISA KEV: Not listed
Published: 2024.05.01

PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV

Exploit probability0.23%

Technical severityCVSS 7.8

Vulnerability overview

Affected product and versions

Product: Linux Linux, linux kernel
Affected versions: >= 430eef03a763e5e76a371ba6d02779ae4a64b6ea < f14cee7a882cb79528f17a2335f53e9fd1848467, >= 430eef03a763e5e76a371ba6d02779ae4a64b6ea < b7deb675d674f44e0ddbab87fee8f9f098925e73, >= 430eef03a763e5e76a371ba6d02779ae4a64b6ea < 825d63164a2e6bacb059a9afb5605425b485413f, >= 430eef03a763e5e76a371ba6d02779ae4a64b6ea < e288285d47784fdcf7c81be56df7d65c6f10c58b, >= 6.3, >= 6.3 < 6.6.24, >= 6.7 < 6.7.12, >= 6.8 < 6.8.3, 6.9
Fixed versions: 6.6.24, 6.7.12, 6.8.3

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

1
Identify
Confirm that Linux Linux, linux kernel and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE: CWE-415