CVE-2026-23306: scsi: pm8001: Fix use-after-free in pm8001_queue_command()

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-03-25 · updated 2026-06-17
Weakness: CWE-416

Description

In the Linux kernel, the following vulnerability has been resolved: scsi: pm8001: Fix use-after-free in pm8001_queue_command() Commit e29c47fe8946 ("scsi: pm8001: Simplify pm8001_task_exec()") refactors pm8001_queue_command(), however it introduces a potential cause of a double free scenario when it changes the function to return -ENODEV in case of phy down/device gone state. In this path, pm8001_queue_command() updates task status and calls task_done to indicate to upper layer that the task has been handled. However, this also frees the underlying SAS task. A -ENODEV is then returned to the caller. When libsas sas_ata_qc_issue() receives this error value, it assumes the task wasn't handled/queued by LLDD and proceeds to clean up and free the task again, resulting in a double free. Since pm8001_queue_command() handles the SAS task in this case, it should return 0 to the caller indicating that the task has been handled.

Affected products

Linux kernel: from 5.18 before 6.1.167; from 6.2 before 6.6.130; from 6.7 before 6.12.77; from 6.13 before 6.18.17; from 6.19 before 6.19.7; 7.0-rc1 — fixed in 6.1.167, 6.12.77, 6.18.17, 6.19.7, 6.6.130

How to fix

Upgrade to a fixed version: Linux kernel 6.1.167, 6.12.77, 6.18.17, 6.19.7. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-23306 or the next vulnerability affects your stack