CVE-2024-26930

What it actually does

Double free of the ha->vp_map pointer in the qla2xxx SCSI driver due to missing NULL assignment after initial kfree in qla2x00_mem_alloc, allowing a subsequent kfree in qla2x00_mem_free to corrupt kernel memory structures.

Why it matters to the business

Local attackers can crash affected Linux systems or potentially escalate privileges on servers using QLogic Fibre Channel adapters, leading to downtime and data integrity risks in storage-heavy environments; low exploit likelihood reduces immediate urgency but patching remains essential for kernel stability.

How an attack unfolds

An attacker with local user access loads or triggers the qla2xxx driver memory allocation paths, causing the vp_map pointer to be freed twice without NULLing; this leads to use-after-free conditions that may be chained for code execution or denial of service on vulnerable kernels.

How to fix it

Upgrade the Linux kernel to the commit f14cee7a882cb79528f17a2335f53e9fd1848467 or later stable releases containing the fix that assigns NULL after the first kfree of vp_map.

How to confirm the fix worked

Verify kernel source contains the NULL assignment after kfree of ha->vp_map in qla2x00_mem_alloc and confirm no double-free path remains in qla2x00_mem_free; test driver load/unload cycles on hardware with the adapter.

Typical attack path

1. Obtain local shell access on target Linux system
2. Trigger qla2x00_mem_alloc and qla2x00_mem_free sequences via driver initialization or I/O operations
3. Exploit resulting double-free for memory corruption
4. Escalate to kernel code execution or cause system panic

How to detect it

Review kernel logs for oops or panic messages referencing qla2xxx and vp_map double-free; inspect crash dumps for repeated kfree calls on the same pointer address during driver unload sequences.

What your security team should do

• Prioritize kernel updates on all systems exposing QLogic qla2xxx hardware
• Monitor for local privilege escalation attempts in audit logs
• Restrict unprivileged local access where feasible until patched
• Reboot systems after applying fixed kernel versions