CVE-2026-23306

About vulnerability

In the Linux kernel, the following vulnerability has been resolved: scsi: pm8001: Fix use-after-free in pm8001_queue_command() Commit e29c47fe8946 (“scsi: pm8001: Simplify pm8001_task_exec()”) refactors pm8001_queue_command(), however it introduces a potential cause of a double free scenario when it changes the function to return -ENODEV in case of phy down/device gone state. In this path, pm8001_queue_command() updates task status and calls task_done to indicate to upper layer that the task has been handled. However, this also frees the underlying SAS task. A -ENODEV is then returned to the caller. When libsas sas_ata_qc_issue() receives this error value, it assumes the task wasn’t handled/queued by LLDD and proceeds to clean up and free the task again, resulting in a double free. Since pm8001_queue_command() handles the SAS task in this case, it should return 0 to the caller indicating that the task has been handled. A flaw was found in the Linux kernel, specifically within the pm8001 SCSI driver and the libsas library. An incorrect return value in the pm8001_queue_command() function, when a physical device is down or gone, can lead to a double free vulnerability. This occurs because the function frees a Serial Attached SCSI (SAS) task but then returns an error, causing the libsas layer to attempt to free the same task again. This double free can result in system instability or a denial of service (DoS).

Live-patch status from KernelCare for each operating system.