Linux Kernel qla2xxx EUVD-2026-28720

Exploitation requires attacker access to the Fibre Channel storage network fabric where vulnerable Linux hosts with QLogic HBAs are connected. The attacker must have the capability to send crafted Fibre Channel Extended Link Service (ELS) frames to the target system - this presumes either physical access to FC switches, compromise of a system already on the FC network, or misconfigured FC zoning that allows unauthorized communication. CVSS vector AV:N/AC:L/PR:N/UI:N suggests network accessibility without authentication, but in practice FC fabrics are typically isolated infrastructure networks with physical and logical access controls. Limiting factors: FC network isolation (most deployments segregate storage networks from data networks), FC zoning policies (restrict which initiators can communicate with which targets), requirement for specialized FC equipment or software to craft malicious frames, need for kernel exploitation techniques to weaponize the double-free. Systems where FC fabrics bridge to less-trusted network zones or where FC-over-Ethernet (FCoE) extends FC into converged networks may face higher realistic exploitation risk than traditional isolated FC SANs.

The CVSS 9.8 rating (AV:N/AC:L/PR:N/UI:N) suggests critical network-accessible risk with no authentication, low complexity, and high impact across confidentiality, integrity, and availability. However, real-world risk signals strongly contradict this severity. EPSS exploitation probability of 0.02% (5th percentile) indicates virtually no observed exploitation attempts. The 'network' attack vector likely reflects Fibre Channel SAN/fabric connectivity rather than internet exposure - FC networks are typically isolated infrastructure networks requiring specialized hardware and access. Exploitation would require an attacker to send crafted Fibre Channel ELS frames to a QLogic HBA, which presumes existing access to the storage network fabric. No CISA KEV listing exists, and no public exploit code is identified. The vulnerability affects enterprise storage infrastructure rather than internet-facing systems. Real priority: LOW to MEDIUM for organizations using QLogic FC HBAs in Linux systems, particularly where storage networks might be accessible to less-trusted zones. CRITICAL CAVEAT: The CVSS AV:N designation conflicts with the driver's specialized hardware context - organizations should verify whether their QLogic HBA configurations expose network attack surfaces beyond typical isolated FC fabrics before prioritizing patching based solely on CVSS score.

An attacker with access to the Fibre Channel storage network crafts malformed Extended Link Service (ELS) frames targeting a Linux host running vulnerable qla2xxx drivers. The malicious ELS command triggers an error path in qla24xx_els_dcmd_iocb(), causing the fcport structure to be freed twice. This double-free corrupts kernel heap memory, allowing the attacker to manipulate kernel data structures or inject code, potentially achieving arbitrary code execution with kernel privileges or crashing the system. No public exploit code identified at time of analysis, but the vulnerability's straightforward nature (error handling bug) makes exploitation technically feasible for attackers with FC fabric access and kernel exploitation expertise.