High 7.8Published Mar 25, 2026

CVE-2026-23306scsi: pm8001: Fix use-after-free in pm8001_queue_command()

Updated under an hour ago (Oct 27, 2026, 2:00 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: scsi: pm8001: Fix use-after-free in pm8001_queue_command() Commit e29c47fe8946 ("scsi: pm8001: Simplify pm8001_task_exec()") refactors pm8001_queue_command(), however it introduces a potential cause of a double free scenario when it changes the function to return -ENODEV in case of phy down/device gone state. In this path, pm8001_queue_command() updates task status and calls task_done to indicate to upper layer that the task has been handled. However, this also frees the underlying SAS task. A -ENODEV is then returned to the caller. When libsas sas_ata_qc_issue() receives this error value, it assumes the task wasn't handled/queued by LLDD and proceeds to clean up and free the task again, resulting in a double free. Since pm8001_queue_command() handles the SAS task in this case, it should return 0 to the caller indicating that the task has been handled.

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: Aug 5, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from e29c47fe8946cc732b0e0d393b65b13c84bb69d0 before ebbb852ffbc952b95ddb7e3872b67b3e74c6da47; from e29c47fe8946cc732b0e0d393b65b13c84bb69d0 before 8b00427317ba7b7ec91252b034009f638d0f311b; from e29c47fe8946cc732b0e0d393b65b13c84bb69d0 before c5dc39f8ae055520fd778b7fb0423f11586f15c4; from e29c47fe8946cc732b0e0d393b65b13c84bb69d0 before 824a7672e3540962d5c77d4c6666254d7aa6f0b3; from e29c47fe8946cc732b0e0d393b65b13c84bb69d0 before 227ff4af00abc40b95123cc27ee8079069dcd8d7; from e29c47fe8946cc732b0e0d393b65b13c84bb69d0 before 38353c26db28efd984f51d426eac2396d299cca7	CNA record
linux linux_kernel linux:linux_kernel	from 5.18 before 6.1.167; from 6.2 before 6.6.130; from 6.7 before 6.12.77; from 6.13 before 6.18.17; from 6.19 before 6.19.7; 7.0	NVD

References

References

https://git.kernel.org/stable/c/ebbb852ffbc952b95ddb7e3872b67b3e74c6da47	patch
https://git.kernel.org/stable/c/8b00427317ba7b7ec91252b034009f638d0f311b	patch
https://git.kernel.org/stable/c/c5dc39f8ae055520fd778b7fb0423f11586f15c4	patch
https://git.kernel.org/stable/c/824a7672e3540962d5c77d4c6666254d7aa6f0b3	patch
https://git.kernel.org/stable/c/227ff4af00abc40b95123cc27ee8079069dcd8d7	patch
https://git.kernel.org/stable/c/38353c26db28efd984f51d426eac2396d299cca7	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.