CVE-2026-23306

Root

Cause

CVE-2026-23306 is a use-after-free vulnerability in the Linux kernel's pm8001 SCSI driver. The bug was introduced by commit e29c47fe8946, which refactored pm8001_queue_command(). In the new code path, when the PHY is down or the device is gone, the function updates the task status, calls task_done (which frees the underlying SAS task), and then returns -ENODEV to the caller. The caller, sas_ata_qc_issue() in libsas, interprets the non-zero return value as an indication that the task was not handled and proceeds to clean up and free the task again, resulting in a double free.

Exploitation

An attacker with local access and the ability to trigger a PHY-down or device-gone condition on a system using the pm8001 driver could cause the driver to enter this vulnerable code path. No special privileges beyond the ability to issue SCSI commands are required; the vulnerability is triggered during normal error handling in the SCSI layer. The double free occurs in kernel memory, which can lead to memory corruption.

Impact

Successful exploitation could allow an attacker to corrupt kernel memory, potentially leading to a denial of service (system crash) or, in more sophisticated scenarios, arbitrary code execution with kernel privileges. The CVSS v3 score of 7.8 (High) reflects the potential for high impact on confidentiality, integrity, and availability.

Mitigation

The fix has been applied to the Linux kernel stable tree. The following commits address the issue: [1], [2], [3], [4]. Users should update their kernel to a version containing these patches. No workaround is available; updating the kernel is the recommended mitigation.