GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-26930 (GCVE-0-2024-26930)

Vulnerability from cvelistv5 – Published: 2024-05-01 05:17 – Updated: 2026-08-05 11:28
VLAI
Title
scsi: qla2xxx: Fix double free of the ha->vp_map pointer
Summary
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix double free of the ha->vp_map pointer Coverity scan reported potential risk of double free of the pointer ha->vp_map. ha->vp_map was freed in qla2x00_mem_alloc(), and again freed in function qla2x00_mem_free(ha). Assign NULL to vp_map and kfree take care of NULL.
Severity
7 (High)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-06-17 17:40 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 430eef03a763e5e76a371ba6d02779ae4a64b6ea , < f14cee7a882cb79528f17a2335f53e9fd1848467 (git)
Affected: 430eef03a763e5e76a371ba6d02779ae4a64b6ea , < b7deb675d674f44e0ddbab87fee8f9f098925e73 (git)
Affected: 430eef03a763e5e76a371ba6d02779ae4a64b6ea , < 825d63164a2e6bacb059a9afb5605425b485413f (git)
Affected: 430eef03a763e5e76a371ba6d02779ae4a64b6ea , < e288285d47784fdcf7c81be56df7d65c6f10c58b (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.3
Unaffected: 0 , < 6.3 (semver)
Unaffected: 6.6.24 , ≤ 6.6.* (semver)
Unaffected: 6.7.12 , ≤ 6.7.* (semver)
Unaffected: 6.8.3 , ≤ 6.8.* (semver)
Unaffected: 6.9 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-26930",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-17T17:40:52.767633Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-17T17:46:59.086Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:21:05.520Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f14cee7a882cb79528f17a2335f53e9fd1848467"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/b7deb675d674f44e0ddbab87fee8f9f098925e73"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/825d63164a2e6bacb059a9afb5605425b485413f"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e288285d47784fdcf7c81be56df7d65c6f10c58b"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/qla2xxx/qla_os.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f14cee7a882cb79528f17a2335f53e9fd1848467",
              "status": "affected",
              "version": "430eef03a763e5e76a371ba6d02779ae4a64b6ea",
              "versionType": "git"
            },
            {
              "lessThan": "b7deb675d674f44e0ddbab87fee8f9f098925e73",
              "status": "affected",
              "version": "430eef03a763e5e76a371ba6d02779ae4a64b6ea",
              "versionType": "git"
            },
            {
              "lessThan": "825d63164a2e6bacb059a9afb5605425b485413f",
              "status": "affected",
              "version": "430eef03a763e5e76a371ba6d02779ae4a64b6ea",
              "versionType": "git"
            },
            {
              "lessThan": "e288285d47784fdcf7c81be56df7d65c6f10c58b",
              "status": "affected",
              "version": "430eef03a763e5e76a371ba6d02779ae4a64b6ea",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/qla2xxx/qla_os.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.3"
            },
            {
              "lessThan": "6.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.24",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.24",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.12",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.3",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Fix double free of the ha-\u003evp_map pointer\n\nCoverity scan reported potential risk of double free of the pointer\nha-\u003evp_map.  ha-\u003evp_map was freed in qla2x00_mem_alloc(), and again freed\nin function qla2x00_mem_free(ha).\n\nAssign NULL to vp_map and kfree take care of NULL."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is only entered from `qla2x00_probe_one()`, i.e. local driver bring-up via module load, sysfs driver bind, or boot-time PCI enumeration; no network or remote-peer data reaches this path.\nAC:H - Triggering requires a kernel memory-allocation failure at one of ~20 specific sites inside the probe, plus the non-default `qlini_mode=exclusive|disabled|dual` (FC target) or `ql2xsecenable=1` on QLA28xx \u2014 neither the timing of the probe nor which allocation fails is under the attacker\u0027s control.\nPR:L - The only attacker-supplied ingredient is memory exhaustion/fragmentation, which any unprivileged local user can create; the probe itself is driven by ordinary system activity (boot, PCI hotplug, udev/driver rebind), so no elevated privilege is needed for the attacker\u0027s half.\nUI:N - Once the allocation failure occurs during probe, the error unwind and the second `kfree()` in `qla2x00_mem_free()` happen automatically inside the kernel with no action by any other user.\nS:U - The corruption is confined to the kernel slab allocator on the same host and crosses no virtualization, IOMMU, or sandbox authority boundary.\nC:H - The double free of the 4 KB `vp_map` object lets the same slab object be handed to two owners, yielding a use-after-free read primitive over whatever kernel structure lands there \u2014 potentially arbitrary kernel memory disclosure.\nI:H - Freelist corruption from the double free gives overlapping allocations, the classic path to controlled kernel heap writes and control-flow hijack; the freed 4 KB object is also a prime heap-spray target.\nA:H - With `CONFIG_SLAB_FREELIST_HARDENED`/SLUB debug the second `kfree()` is detected and BUG()s immediately; without it, freelist corruption reliably leads to an oops or panic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:28:25.607Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f14cee7a882cb79528f17a2335f53e9fd1848467"
        },
        {
          "url": "https://git.kernel.org/stable/c/b7deb675d674f44e0ddbab87fee8f9f098925e73"
        },
        {
          "url": "https://git.kernel.org/stable/c/825d63164a2e6bacb059a9afb5605425b485413f"
        },
        {
          "url": "https://git.kernel.org/stable/c/e288285d47784fdcf7c81be56df7d65c6f10c58b"
        }
      ],
      "title": "scsi: qla2xxx: Fix double free of the ha-\u003evp_map pointer",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26930",
    "datePublished": "2024-05-01T05:17:10.685Z",
    "dateReserved": "2024-02-19T14:20:24.195Z",
    "dateUpdated": "2026-08-05T11:28:25.607Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-26930",
      "date": "2026-09-15",
      "epss": "0.00232",
      "percentile": "0.14226"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"6.6.24\", \"matchCriteriaId\": \"B6EDF98F-EEBC-45A5-B968-B78881A5BE83\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartExcluding\": \"6.7\", \"versionEndExcluding\": \"6.7.12\", \"matchCriteriaId\": \"3CFA8A81-15BA-4322-A5C1-9450955D5E4B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartExcluding\": \"6.8\", \"versionEndExcluding\": \"6.8.3\", \"matchCriteriaId\": \"1649B701-9DF9-4E5D-AA4B-6A7071BF05D6\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"22BEDD49-2C6D-402D-9DBF-6646F6ECD10B\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nscsi: qla2xxx: Fix double free of the ha-\u003evp_map pointer\\n\\nCoverity scan reported potential risk of double free of the pointer\\nha-\u003evp_map.  ha-\u003evp_map was freed in qla2x00_mem_alloc(), and again freed\\nin function qla2x00_mem_free(ha).\\n\\nAssign NULL to vp_map and kfree take care of NULL.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: scsi: qla2xxx: Correcci\\u00f3n de doble liberaci\\u00f3n del puntero ha-\u0026gt;vp_map Coverity scan inform\\u00f3 un riesgo potencial de doble liberaci\\u00f3n del puntero ha-\u0026gt;vp_map. ha-\u0026gt;vp_map se liber\\u00f3 en qla2x00_mem_alloc() y nuevamente se liber\\u00f3 en la funci\\u00f3n qla2x00_mem_free(ha). Asigne NULL a vp_map y kfree se encargar\\u00e1 de NULL.\"}]",
      "id": "CVE-2024-26930",
      "lastModified": "2024-11-21T09:03:24.700",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 5.9}]}",
      "published": "2024-05-01T06:15:07.540",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/825d63164a2e6bacb059a9afb5605425b485413f\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/b7deb675d674f44e0ddbab87fee8f9f098925e73\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/e288285d47784fdcf7c81be56df7d65c6f10c58b\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/f14cee7a882cb79528f17a2335f53e9fd1848467\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/825d63164a2e6bacb059a9afb5605425b485413f\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/b7deb675d674f44e0ddbab87fee8f9f098925e73\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/e288285d47784fdcf7c81be56df7d65c6f10c58b\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/f14cee7a882cb79528f17a2335f53e9fd1848467\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-415\"}]}]"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-18T02:11:51.000Z",
      "cve": "CVE-2024-26930",
      "id": "msrc_CVE-2024-26930",
      "initial_release_date": "2024-05-02T07:00:00.000Z",
      "product_status:fixed": "2",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "scsi: qla2xxx: Fix double free of the ha-\u003evp_map pointer",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-26930.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-26930\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-01T06:15:07.540\",\"lastModified\":\"2026-08-04T11:17:23.170\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nscsi: qla2xxx: Fix double free of the ha-\u003evp_map pointer\\n\\nCoverity scan reported potential risk of double free of the pointer\\nha-\u003evp_map.  ha-\u003evp_map was freed in qla2x00_mem_alloc(), and again freed\\nin function qla2x00_mem_free(ha).\\n\\nAssign NULL to vp_map and kfree take care of NULL.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: scsi: qla2xxx: Correcci\u00f3n de doble liberaci\u00f3n del puntero ha-\u0026gt;vp_map Coverity scan inform\u00f3 un riesgo potencial de doble liberaci\u00f3n del puntero ha-\u0026gt;vp_map. ha-\u0026gt;vp_map se liber\u00f3 en qla2x00_mem_alloc() y nuevamente se liber\u00f3 en la funci\u00f3n qla2x00_mem_free(ha). Asigne NULL a vp_map y kfree se encargar\u00e1 de NULL.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/scsi/qla2xxx/qla_os.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"430eef03a763e5e76a371ba6d02779ae4a64b6ea\",\"lessThan\":\"f14cee7a882cb79528f17a2335f53e9fd1848467\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"430eef03a763e5e76a371ba6d02779ae4a64b6ea\",\"lessThan\":\"b7deb675d674f44e0ddbab87fee8f9f098925e73\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"430eef03a763e5e76a371ba6d02779ae4a64b6ea\",\"lessThan\":\"825d63164a2e6bacb059a9afb5605425b485413f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"430eef03a763e5e76a371ba6d02779ae4a64b6ea\",\"lessThan\":\"e288285d47784fdcf7c81be56df7d65c6f10c58b\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/scsi/qla2xxx/qla_os.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.3\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.3\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.24\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.7.12\",\"lessThanOrEqual\":\"6.7.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.8.3\",\"lessThanOrEqual\":\"6.8.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.9\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.0,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.0,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-06-17T17:40:52.767633Z\",\"id\":\"CVE-2024-26930\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-415\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.3\",\"versionEndExcluding\":\"6.6.24\",\"matchCriteriaId\":\"8CF9EBD7-10AE-400D-BB67-06C2F3EBA390\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.7.12\",\"matchCriteriaId\":\"6BE9771A-BAFD-4624-95F9-58D536540C53\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.8\",\"versionEndExcluding\":\"6.8.3\",\"matchCriteriaId\":\"4C59BBC3-6495-4A77-9C82-55EC7CDF5E02\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"22BEDD49-2C6D-402D-9DBF-6646F6ECD10B\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/825d63164a2e6bacb059a9afb5605425b485413f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b7deb675d674f44e0ddbab87fee8f9f098925e73\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e288285d47784fdcf7c81be56df7d65c6f10c58b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f14cee7a882cb79528f17a2335f53e9fd1848467\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/825d63164a2e6bacb059a9afb5605425b485413f\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b7deb675d674f44e0ddbab87fee8f9f098925e73\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e288285d47784fdcf7c81be56df7d65c6f10c58b\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f14cee7a882cb79528f17a2335f53e9fd1848467\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-18T14:31:31+00:00",
      "cve": "CVE-2024-26930",
      "id": "CVE-2024-26930",
      "initial_release_date": "2024-05-01T00:00:00+00:00",
      "product_status:fixed": "513",
      "product_status:known_affected": "90",
      "product_status:known_not_affected": "23",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: scsi: qla2xxx: Fix double free of the ha-\u0026gt;vp_map pointer",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-26930.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-08-29T01:57:39Z",
      "cve": "CVE-2024-26930",
      "id": "CVE-2024-26930",
      "initial_release_date": "2024-05-03T02:09:53Z",
      "product_status:known_affected": "269",
      "product_status:known_not_affected": "266",
      "product_status:recommended": "1022",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-26930",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-26930.json",
      "version": "119"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/f14cee7a882cb79528f17a2335f53e9fd1848467\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/b7deb675d674f44e0ddbab87fee8f9f098925e73\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/825d63164a2e6bacb059a9afb5605425b485413f\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/e288285d47784fdcf7c81be56df7d65c6f10c58b\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T00:21:05.520Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-26930\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-06-17T17:40:52.767633Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-06-17T17:40:53.797Z\"}}], \"cna\": {\"title\": \"scsi: qla2xxx: Fix double free of the ha-\u003evp_map pointer\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The vulnerable code is only entered from `qla2x00_probe_one()`, i.e. local driver bring-up via module load, sysfs driver bind, or boot-time PCI enumeration; no network or remote-peer data reaches this path.\\nAC:H - Triggering requires a kernel memory-allocation failure at one of ~20 specific sites inside the probe, plus the non-default `qlini_mode=exclusive|disabled|dual` (FC target) or `ql2xsecenable=1` on QLA28xx \\u2014 neither the timing of the probe nor which allocation fails is under the attacker\u0027s control.\\nPR:L - The only attacker-supplied ingredient is memory exhaustion/fragmentation, which any unprivileged local user can create; the probe itself is driven by ordinary system activity (boot, PCI hotplug, udev/driver rebind), so no elevated privilege is needed for the attacker\u0027s half.\\nUI:N - Once the allocation failure occurs during probe, the error unwind and the second `kfree()` in `qla2x00_mem_free()` happen automatically inside the kernel with no action by any other user.\\nS:U - The corruption is confined to the kernel slab allocator on the same host and crosses no virtualization, IOMMU, or sandbox authority boundary.\\nC:H - The double free of the 4 KB `vp_map` object lets the same slab object be handed to two owners, yielding a use-after-free read primitive over whatever kernel structure lands there \\u2014 potentially arbitrary kernel memory disclosure.\\nI:H - Freelist corruption from the double free gives overlapping allocations, the classic path to controlled kernel heap writes and control-flow hijack; the freed 4 KB object is also a prime heap-spray target.\\nA:H - With `CONFIG_SLAB_FREELIST_HARDENED`/SLUB debug the second `kfree()` is detected and BUG()s immediately; without it, freelist corruption reliably leads to an oops or panic.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"430eef03a763e5e76a371ba6d02779ae4a64b6ea\", \"lessThan\": \"f14cee7a882cb79528f17a2335f53e9fd1848467\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"430eef03a763e5e76a371ba6d02779ae4a64b6ea\", \"lessThan\": \"b7deb675d674f44e0ddbab87fee8f9f098925e73\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"430eef03a763e5e76a371ba6d02779ae4a64b6ea\", \"lessThan\": \"825d63164a2e6bacb059a9afb5605425b485413f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"430eef03a763e5e76a371ba6d02779ae4a64b6ea\", \"lessThan\": \"e288285d47784fdcf7c81be56df7d65c6f10c58b\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/scsi/qla2xxx/qla_os.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.3\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.3\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.6.24\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.7.12\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.7.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8.3\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.8.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/scsi/qla2xxx/qla_os.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/f14cee7a882cb79528f17a2335f53e9fd1848467\"}, {\"url\": \"https://git.kernel.org/stable/c/b7deb675d674f44e0ddbab87fee8f9f098925e73\"}, {\"url\": \"https://git.kernel.org/stable/c/825d63164a2e6bacb059a9afb5605425b485413f\"}, {\"url\": \"https://git.kernel.org/stable/c/e288285d47784fdcf7c81be56df7d65c6f10c58b\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nscsi: qla2xxx: Fix double free of the ha-\u003evp_map pointer\\n\\nCoverity scan reported potential risk of double free of the pointer\\nha-\u003evp_map.  ha-\u003evp_map was freed in qla2x00_mem_alloc(), and again freed\\nin function qla2x00_mem_free(ha).\\n\\nAssign NULL to vp_map and kfree take care of NULL.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.24\", \"versionStartIncluding\": \"6.3\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.7.12\", \"versionStartIncluding\": \"6.3\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8.3\", \"versionStartIncluding\": \"6.3\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9\", \"versionStartIncluding\": \"6.3\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:28:25.607Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-26930\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:28:25.607Z\", \"dateReserved\": \"2024-02-19T14:20:24.195Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-01T05:17:10.685Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.