---
id: CVE-2025-68741
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  scsi: qla2xxx: Fix improper freeing of purex item

  In qla2xxx_process_purls_iocb(), an item is allocated via
  qla27xx_copy_multiple_pkt(), which internally calls
  qla24xx…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  scsi: qla2xxx: Fix improper freeing of purex item

  In qla2xxx_process_purls_iocb(), an item is allocated via
  qla27xx_copy_multiple_pkt(), which internally calls
  qla24xx…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
published: '2025-12-24'
updated: '2026-10-13'
sourceUpdated: '2026-10-13T10:10:00.193'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-68741'
references:
  - url: 'https://git.kernel.org/stable/c/4bccd506a1f1ab01d1f45b2a3effff6bedc73cf9'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/5fa1c8226b4532ad7011d295d3ab4ad45df105ae'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/78b1a242fe612a755f2158fd206ee6bb577d18ca'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/8e9f0a0717ba31d5842721627ade1e62d7aec012'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/cfe3e2f768d248fd3d965d561d0768a56dd0b9f8'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
epss: 0.0043
epssPercentile: 0.35361
ingestedAt: '2026-10-13T10:22:03.517Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Fix improper freeing of purex item

In qla2xxx_process_purls_iocb(), an item is allocated via
qla27xx_copy_multiple_pkt(), which internally calls
qla24xx_alloc_purex_item().

The qla24xx_alloc_purex_item() function may return a pre-allocated item
from a per-adapter pool for small allocations, instead of dynamically
allocating memory with kzalloc().

An error handling path in qla2xxx_process_purls_iocb() incorrectly uses
kfree() to release the item. If the item was from the pre-allocated
pool, calling kfree() on it is a bug that can lead to memory corruption.

Fix this by using the correct deallocation function,
qla24xx_free_purex_item(), which properly handles both dynamically
allocated and pre-allocated items.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.