CVE-2024-26929

What it actually does

Double free of fcport structure in qla2xxx driver after LOGO ELS command, causing invalid kfree and kernel BUG in set_freepointer/slub allocator.

Why it matters to the business

Unexpected crashes on Linux servers with QLogic Fibre Channel adapters disrupt storage connectivity, causing downtime for databases, virtual machines, and enterprise workloads until patched.

How an attack unfolds

An attacker with local access or the ability to trigger Fibre Channel ELS commands issues a LOGO that invokes qla2x00_issue_logo, which calls the double-free path in qla2x00_els_dcmd_sp_free leading to kernel panic; no widespread remote exploitation observed.

How to fix it

Upgrade linux package on Debian 12 to 6.1.85-1 or later and on Debian 13 to 6.7.12-1 or later; rebuild and reboot with the fixed kernel; avoid manual kfree on fcport objects.

How to confirm the fix worked

Verify installed kernel version matches or exceeds the listed fixed packages; reproduce LOGO sequence in a test environment and confirm absence of double-free BUG; inspect qla2xxx source for qla2x00_free_fcport usage.

Typical attack path

1. Obtain local access or control over Fibre Channel initiator on affected host
2. Trigger ELS LOGO command via qla2x00_issue_logo
3. Execute qla2x00_els_dcmd_iocb leading to duplicate free of fcport
4. Trigger kfree on already-freed object causing slub corruption and BUG

How to detect it

Search kernel logs and crash dumps for BUG at mm/slub.c, set_freepointer, qla2x00_els_dcmd_sp_free, qla2x00_issue_logo, and qla2xxx module traces indicating double free of fcport.

• kernel BUG at mm/slub.c:371!
• qla2x00_els_dcmd_sp_free+0x20/0x230
• qla2x00_issue_logo+0x28c/0x2a0
• set_freepointer.part.57+0x0/0x10
• qla24xx_els_dcmd_iocb

What your security team should do

• Patch all affected Debian systems to the specified fixed kernel versions immediately
• Prioritize hosts with QLogic adapters in production storage paths
• Monitor kernel logs for qla2xxx double-free signatures until patching completes
• Test storage failover paths before deploying the update