CVE-2025-68741
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
In the Linux kernel, the qla2xxx SCSI driver has a bug where it incorrectly frees a purex item using kfree() instead of qla24xx_free_purex_item(), which can cause memory corruption when the item comes from a pre-allocated pool.
Risk Assessment
This may lead to memory corruption and system crashes in environments using QLogic Fibre Channel adapters.
Recommendation
Apply the patch that replaces kfree() with the correct qla24xx_free_purex_item() function.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix improper freeing of purex item In qla2xxx_process_purls_iocb(), an item is allocated via qla27xx_copy_multiple_pkt(), which internally calls qla24xx_alloc_purex_item(). The qla24xx_alloc_purex_item() function may return a pre-allocated item from a per-adapter pool for small allocations, instead of dynamically allocating memory with kzalloc(). An error handling path in qla2xxx_process_purls_iocb() incorrectly uses kfree() to release the item. If the item was from the pre-allocated pool, calling kfree() on it is a bug that can lead to memory corruption. Fix this by using the correct deallocation function, qla24xx_free_purex_item(), which properly handles both dynamically allocated and pre-allocated items.