Memory corruption (double free) in the Linux kernel btrfs filesystem's quota group (qgroup) accounting affects the add_delayed_ref_head() code path when a qgroup record is reported as already existing but a subsequent error occurs, causing both caller and callee to free the same 'qrecord' object. The flaw is a local btrfs-triggered condition on systems using btrfs with quota groups; there is no public exploit identified at time of analysis and it is not listed in CISA KEV, with a very low EPSS of 0.17%. Despite an automated CVSS of 9.8, the realistic attack surface is local to the machine and gated by a hard-to-reach error path.
Kernel instability in the Linux qla2xxx SCSI driver (QLogic Fibre Channel target/host adapter) allows a chip-reset event to leave in-flight commands stuck and never freed, and can trigger a BUG_ON kernel panic (BUG_ON(cmd->sg_mapped) or BUG_ON(!valid_dma_direction(dir))) when two CPUs race to unmap the same scatter-gather list. This fix reverts commit 26f9ce53817a and partially reverts aefed3e5548f at __qla2x00_abort_all_cmds to restore correct command cleanup after a firmware/chip reset. No public exploit identified at time of analysis; the NVD-assigned CVSS of 9.8 (AV:N) is inconsistent with the local, hardware-dependent nature of the bug.
Memory corruption in the Linux kernel's qla2xxx QLogic Fibre Channel HBA driver arises from an error-handling path in qla2xxx_process_purls_iocb() that calls kfree() on a purex item which may have originated from a per-adapter pre-allocated pool rather than kzalloc(). Freeing a pool-backed object with kfree() can corrupt kernel heap state. The fix routes deallocation through qla24xx_free_purex_item(), which correctly distinguishes dynamically allocated from pooled items; no public exploit identified at time of analysis, and the issue is not in CISA KEV.
Kernel-side memory corruption in the Linux kernel's crypto AEAD framework arises because AEAD algorithms began populating the generic cra_reqsize field (added by commit afddce13ce81d) without the framework being updated to translate it into a proper per-request size via crypto_aead_set_reqsize(). As a result, request buffers for affected AEAD transforms are undersized, producing out-of-bounds memory writes and kernel crashes when the algorithm is used. This is tracked as a Denial-of-Service class issue; no public exploit identified at time of analysis, and it is not listed in CISA KEV.