---
id: CVE-2021-46963
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  scsi: qla2xxx: Fix crash in qla2xxx_mqueuecommand()

      RIP: 0010:kmem_cache_free+0xfa/0x1b0
      Call Trace:
         qla2xxx_mqueuecommand+0x2b5/0x2c0 [qla2xxx]
         …
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  scsi: qla2xxx: Fix crash in qla2xxx_mqueuecommand()

      RIP: 0010:kmem_cache_free+0xfa/0x1b0
      Call Trace:
         qla2xxx_mqueuecommand+0x2b5/0x2c0 [qla2xxx]
         …
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 4.19.90, < 4.19.191'
  - 'linux_kernel >= 5.4.4, < 5.4.118'
  - 'linux_kernel >= 5.5, < 5.10.36'
  - 'linux_kernel >= 5.11, < 5.11.20'
  - 'linux_kernel >= 5.12, < 5.12.3'
patched:
  - linux_kernel 5.12.3
published: '2024-02-27'
updated: '2026-08-04'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2021-46963'
references:
  - url: 'https://git.kernel.org/stable/c/6641df81ab799f28a5d564f860233dd26cca0d93'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/702cdaa2c6283c135ef16d52e0e4e3c1005aa538'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/77509a238547863040a42d57c72403f7d4c89a8f'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/80ef24175df2cba3860d0369d1c662b49ee2de56'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/a73208e3244127ef9f2cdf24e4adb947aaa32053'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/c5ab9b67d8b061de74e2ca51bf787ee599bd7f89'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/6641df81ab799f28a5d564f860233dd26cca0d93'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://git.kernel.org/stable/c/702cdaa2c6283c135ef16d52e0e4e3c1005aa538'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://git.kernel.org/stable/c/77509a238547863040a42d57c72403f7d4c89a8f'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://git.kernel.org/stable/c/80ef24175df2cba3860d0369d1c662b49ee2de56'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://git.kernel.org/stable/c/a73208e3244127ef9f2cdf24e4adb947aaa32053'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://git.kernel.org/stable/c/c5ab9b67d8b061de74e2ca51bf787ee599bd7f89'
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
epss: 0.00246
epssPercentile: 0.14111
ingestedAt: '2026-08-04T10:39:38.586Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Fix crash in qla2xxx_mqueuecommand()

    RIP: 0010:kmem_cache_free+0xfa/0x1b0
    Call Trace:
       qla2xxx_mqueuecommand+0x2b5/0x2c0 [qla2xxx]
       scsi_queue_rq+0x5e2/0xa40
       __blk_mq_try_issue_directly+0x128/0x1d0
       blk_mq_request_issue_directly+0x4e/0xb0

Fix incorrect call to free srb in qla2xxx_mqueuecommand(), as srb is now
allocated by upper layers. This fixes smatch warning of srb unintended
free.

## Affected

- `linux_kernel >= 4.19.90, < 4.19.191`
- `linux_kernel >= 5.4.4, < 5.4.118`
- `linux_kernel >= 5.5, < 5.10.36`
- `linux_kernel >= 5.11, < 5.11.20`
- `linux_kernel >= 5.12, < 5.12.3`

## Remediation

Upgrade past the affected range:

- `linux_kernel 5.12.3`