Critical 9.8Published Dec 24, 2025

CVE-2025-68741scsi: qla2xxx: Fix improper freeing of purex item

Updated under an hour ago (Oct 28, 2026, 8:40 AM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix improper freeing of purex item In qla2xxx_process_purls_iocb(), an item is allocated via qla27xx_copy_multiple_pkt(), which internally calls qla24xx_alloc_purex_item(). The qla24xx_alloc_purex_item() function may return a pre-allocated item from a per-adapter pool for small allocations, instead of dynamically allocating memory with kzalloc(). An error handling path in qla2xxx_process_purls_iocb() incorrectly uses kfree() to release the item. If the item was from the pre-allocated pool, calling kfree() on it is a bug that can lead to memory corruption. Fix this by using the correct deallocation function, qla24xx_free_purex_item(), which properly handles both dynamically allocated and pre-allocated items.

CVSS: 9.8 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Deferred
Record last updated: Aug 5, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	875386b98857822b77ac7f95bdf367b70af5b78c builds before 4bccd506a1f1ab01d1f45b2a3effff6bedc73cf9; 875386b98857822b77ac7f95bdf367b70af5b78c builds before 8e9f0a0717ba31d5842721627ade1e62d7aec012; from 875386b98857822b77ac7f95bdf367b70af5b78c before cfe3e2f768d248fd3d965d561d0768a56dd0b9f8; 875386b98857822b77ac7f95bdf367b70af5b78c builds before 5fa1c8226b4532ad7011d295d3ab4ad45df105ae; 875386b98857822b77ac7f95bdf367b70af5b78c builds before 78b1a242fe612a755f2158fd206ee6bb577d18ca	CNA record

References

References

https://git.kernel.org/stable/c/4bccd506a1f1ab01d1f45b2a3effff6bedc73cf9
https://git.kernel.org/stable/c/8e9f0a0717ba31d5842721627ade1e62d7aec012
https://git.kernel.org/stable/c/cfe3e2f768d248fd3d965d561d0768a56dd0b9f8
https://git.kernel.org/stable/c/5fa1c8226b4532ad7011d295d3ab4ad45df105ae
https://git.kernel.org/stable/c/78b1a242fe612a755f2158fd206ee6bb577d18ca

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.