HIGH
scsi pm8001 Task UAF
CVE-2026-23306
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.8HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: scsi: pm8001: Fix use-after-free in pm8001_queue_command() Commit e29c47fe8946 ("scsi: pm8001: Simplify pm8001_task_exec()") refactors pm8001_queue_command(), however it introduces a potential cause of a double free scenario when it changes the function to return -ENODEV in case of phy down/device gone state. In this path, pm8001_queue_command() updates task status and calls task_done to indicate to upper layer that the task has been handled. However, this also frees the underlying SAS task. A -ENODEV is then returned to the caller. When libsas sas_ata_qc_issue() receives this error value, it assumes the task wasn't handled/queued by LLDD and proceeds to clean up and free the task again, resulting in a double free. Since pm8001_queue_command() handles the SAS task in this case, it should return 0 to the caller indicating that the task has been handled.
02KernelScan AI Analysis
Risk summary
Local attackers with low privileges can trigger a use-after-free vulnerability in the pm8001 SCSI driver when SAS devices are in a down/gone state. This can lead to kernel memory corruption, privilege escalation, or system crashes on systems with pm8001-based SAS controllers.
Vulnerability analysis
The vulnerability stems from incorrect error handling in pm8001_queue_command() where the function calls task_done() to free a SAS task but then returns -ENODEV to the caller. The libsas layer interprets this error code as meaning the task was never handled and attempts to free it again, causing a double-free condition. The fix changes the return value to 0 when the task has been handled, preventing the double-free by correctly signaling to the caller that the task was processed.
03Fix Versions
| Branch | Fixed in | Patch commit |
|---|---|---|
| 6.1 | 6.1.167 | ebbb852ffbc9 |
| 6.12 | 6.12.77 | c5dc39f8ae05 |
| 6.18 | 6.18.17 | 824a7672e354 |
| 6.19 | 6.19.7 | 227ff4af00ab |
| 6.6 | 6.6.130 | 8b00427317ba |
| mainline | 7.0 | 38353c26db28 |