{"id":"CVE-2026-64118","revision":"26dd0b3a29b34405bfdef2ede0a6c398","records":[{"revision":"26dd0b3a29b34405bfdef2ede0a6c398","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-64118","aliases":[],"title":"qed: fix double free in qed_cxt_tables_alloc()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nqed: fix double free in qed_cxt_tables_alloc()\n\nIf one of the later PF or VF CID bitmap allocations fails,\nqed_cid_map_alloc() jumps to cid_map_fail and frees the previously\nallocated CID bitmaps before returning an error. qed_cxt_tables_alloc()\nthen calls qed_cxt_mngr_free(), which invokes qed_cid_map_free()\nagain.\n\nFix this by setting each CID bitmap pointer to NULL after bitmap_free()\nto avoid double free.\n\nThe bug was first flagged by an experimental analysis tool we are\ndeveloping for kernel memory-management bugs while analyzing\nv6.13-rc1. The tool is still under development and is not yet publicly\navailable. Manual inspection confirms that the bug is still\npresent in v7.1-rc3.\n\nRuntime reproduction was not attempted because exercising the failing\nallocation path requires device-specific setup.","state":0,"publishedAt":"2026-07-19T15:40:17.643+00:00","modifiedAt":"2026-10-19T20:28:13.114+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/net/ethernet/qlogic/qed/qed_cxt.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"fe56b9e6a8d957d6a20729d626027f800c17a2da\",\n                            \"lessThan\": \"9fe030719bd083b766602692ee96c8c985798e3c\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"fe56b9e6a8d957d6a20729d626027f800c17a2da\",\n                            \"lessThan\": \"06fa8e69019fd3c41a7b0ea8c5f509c3a33dc227\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"fe56b9e6a8d957d6a20729d626027f800c17a2da\",\n                            \"lessThan\": \"8cf5e4d2ca6b101d163c7423a426fb0aec34f7bb\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"fe56b9e6a8d957d6a20729d626027f800c17a2da\",\n                            \"lessThan\": \"3904b993cc17ec5d7c5d3b57dbd0b775dafb9684\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"fe56b9e6a8d957d6a20729d626027f800c17a2da\",\n                            \"lessThan\": \"bdf678a273cadbccc347f331ae2e93ff4d14834c\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"fe56b9e6a8d957d6a20729d626027f800c17a2da\",\n                            \"lessThan\": \"0e47fc1c9181ae029e0e35a865cbf2adcbae626c\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"fe56b9e6a8d957d6a20729d626027f800c17a2da\",\n                            \"lessThan\": \"a04c207f0801abdd23a169b5f902a9845059a65a\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"fe56b9e6a8d957d6a20729d626027f800c17a2da\",\n                            \"lessThan\": \"2bccfb8476ca5f3548afbd623dc7a6980d4e77de\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/net/ethernet/qlogic/qed/qed_cxt.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"4.4\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"4.4\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.259\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.210\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.175\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.142\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.92\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.34\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.0.11\",\n                            \"lessThanOrEqual\": \"7.0.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.1\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":8.4,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/9fe030719bd083b766602692ee96c8c985798e3c","https://git.kernel.org/stable/c/06fa8e69019fd3c41a7b0ea8c5f509c3a33dc227","https://git.kernel.org/stable/c/8cf5e4d2ca6b101d163c7423a426fb0aec34f7bb","https://git.kernel.org/stable/c/3904b993cc17ec5d7c5d3b57dbd0b775dafb9684","https://git.kernel.org/stable/c/bdf678a273cadbccc347f331ae2e93ff4d14834c","https://git.kernel.org/stable/c/0e47fc1c9181ae029e0e35a865cbf2adcbae626c","https://git.kernel.org/stable/c/a04c207f0801abdd23a169b5f902a9845059a65a","https://git.kernel.org/stable/c/2bccfb8476ca5f3548afbd623dc7a6980d4e77de"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-64118","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-64118","identifiers":["CVE-2026-64118"]},"retained":false,"historicalAffected":[]}],"coverage":[]}