CVE-2026-23306: scsi: pm8001: Fix use-after-free in pm8001_queue_command()
In the Linux kernel, the following vulnerability has been resolved:
scsi: pm8001: Fix use-after-free in pm8001queuecommand()
Commit e29c47fe8946 ("scsi: pm8001: Simplify pm8001taskexec()") refactors pm8001queuecommand(), however it introduces a potential cause of a double free scenario when it changes the function to return -ENODEV in case of phy down/device gone state.
In this path, pm8001queuecommand() updates task status and calls taskdone to indicate to upper layer that the task has been handled. However, this also frees the underlying SAS task. A -ENODEV is then returned to the caller. When libsas sasataqcissue() receives this error value, it assumes the task wasn't handled/queued by LLDD and proceeds to clean up and free the task again, resulting in a double free.
Since pm8001queuecommand() handles the SAS task in this case, it should return 0 to the caller indicating that the task has been handled.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23306?
CVE-2026-23306 is classified as a high severity vulnerability due to the potential for a use-after-free condition.
How do I fix CVE-2026-23306?
To fix CVE-2026-23306, it is recommended to update the Linux kernel to the latest version that includes the patch for this vulnerability.
Which versions of the Linux kernel are affected by CVE-2026-23306?
CVE-2026-23306 affects versions of the Linux kernel that include the pm8001 driver prior to the release that incorporates the fix.
What issues could CVE-2026-23306 cause if exploited?
If exploited, CVE-2026-23306 could lead to system crashes or arbitrary code execution on affected systems.
Who is responsible for patching CVE-2026-23306 in the Linux kernel?
The maintainers of the Linux kernel are responsible for applying the patch for CVE-2026-23306 to ensure system security.