LiveActive security incident?Get immediate response
CVE Record

CVE-2026-23306: scsi: pm8001: Fix use-after-free in pm8001_queue_command()

In the Linux kernel, the following vulnerability has been resolved: scsi: pm8001: Fix use-after-free in pm8001_queue_command() Commit e29c47fe8946 ("scsi: pm8001: Simplify pm8001_task_exec()") refactors pm8001_queue_command(), however it introduces a potential cause of a double free scenario when it changes the function to return -ENODEV in case of phy down/device gone state. In this path, pm8001_queue_command() updates task status and calls task_done to indicate to upper layer that the task has been handled. However, this also frees the underlying SAS task. A -ENODEV is then returned to the caller. When libsas sas_ata_qc_issue() receives this error value, it assumes the task wasn't handled/queued by LLDD and proceeds to clean up and free the task again, resulting in a double free. Since pm8001_queue_command() handles the SAS task in this case, it should return 0 to the caller indicating that the task has been handled.

HighCVSS 7.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A Linux storage-driver flaw can free the same storage task twice when a device disappears or its physical link fails. The resulting kernel memory corruption could cause crashes or potentially compromise confidentiality and integrity. Exposure is narrower than a general Linux flaw because the vulnerable pm8001 storage path must be relevant.

Executive priority

Prioritize storage-critical systems using pm8001 for prompt validation and patching. The potential impact is high, but the local-access requirement and hardware-specific driver path reduce broad internet-facing risk. Lower priority only after confirming the vulnerable driver path is absent or the vendor fix is installed.

Technical view

Commit e29c47fe8946 changed pm8001_queue_command() to return -ENODEV after task_done had already freed the SAS task. libsas interprets that error as meaning the task was not handled and frees it again. The stable fixes return 0 because the driver already completed the task.

Likely exposure

Likely exposure is limited to Linux hosts running affected kernel code where the pm8001 driver and relevant SAS/ATA device path are used. The bundle lists versions across several kernel lines, but does not provide reliable distribution-package boundaries or clarify the anomalous version entry "0"; vendor backports require verification.

Exploitation context

CVSS 3.1 is 7.8, with local access, low privileges, low complexity, and no user interaction. Successful exploitation could affect confidentiality, integrity, and availability. The bundle reports KEV false and provides no cited evidence of active exploitation or a public exploit.

Researcher notes

The defect is a double free caused by disagreement between driver completion semantics and libsas error handling. Returning -ENODEV after task_done makes the upper layer perform duplicate cleanup; returning 0 communicates prior handling. The source bundle names stable fix commits but gives incomplete affected-range semantics, no CWE, and no exploitation evidence.

Mitigation direction

  • Apply a vendor kernel update containing the applicable upstream stable fix.
  • Confirm distribution backports rather than relying only on the displayed kernel version.
  • Restrict unnecessary local account access as a temporary compensating control.
  • Follow Linux distribution guidance if an applicable fixed package is not yet identified.

Validation and detection

  • Inventory hosts using the pm8001 driver and associated SAS or ATA storage.
  • Map installed kernel packages to vendor advisories and backported fix commits.
  • Verify the running kernel contains the applicable cited stable fix after updating.
  • Review kernel crashes and memory-corruption reports involving pm8001 or SAS task handling.
Prepared
Confidence
medium
Sources
8

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-23306 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
0ADP providers
7Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2026-23306Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxe29c47fe8946cc732b0e0d393b65b13c84bb69d0, e29c47fe8946cc732b0e0d393b65b13c84bb69d0, e29c47fe8946cc732b0e0d393b65b13c84bb69d0, e29c47fe8946cc732b0e0d393b65b13c84bb69d0, e29c47fe8946cc732b0e0d393b65b13c84bb69d0, e29c47fe8946cc732b0e0d393b65b13c84bb69d0unaffected
LinuxLinux5.18, 0, 6.1.167, 6.6.130, 6.12.77, 6.18.17, 6.19.7, 7.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.