CVE Explorer

CVE-2026-23306

In the Linux kernel, the following vulnerability has been resolved: scsi: pm8001: Fix use-after-free in pm8001_queue_command() Commit e29c47fe8946 ("scsi: pm8001: Simplify pm8001_task_exec()") refactors pm8001_queue_command(), however it introduces a potential cause of a double free scenario when it changes the function to return -ENODEV in case of phy down/device gone state. In this path, pm8001_queue_command() updates task status and calls task_done to indicate to upper layer that the task

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:06a656d97728a781fd888bf3078a1329ab327061bdac71ce436e7d117e07dd05

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Preserved source conflicts

No provider value was silently selected as the winner.

affected · 2 assertions

{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/scsi/pm8001/pm8001_sas.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"ebbb852ffbc952b95ddb7e3872b67b3e74c6da47","status":"affected","version":"e29c47fe8946cc732b0e0d393b65b13c84bb69d0","versionType":"git"},{"lessThan":"8b00427317ba7b7ec91252b034009f638d0f311b","status":"affected","version":"e29c47fe8946cc732b0e0d393b65b13c84bb69d0","versionType":"git"},{"lessThan":"c5dc39f8ae055520fd778b7fb0423f11586f15c4","status":"affected","version":"e29c47fe8946c…

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:b2b9345a058c3298aa99f120ea1a34dc16f2474a90062aa814f0dfa5cae1e3d4 · sha256:5dc25a55b8dd66e5… · /containers/cna/affected/0

{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/scsi/pm8001/pm8001_sas.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.18"},{"lessThan":"5.18","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.167","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.130","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.77","versionType":"semver"},{…

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:b2b9345a058c3298aa99f120ea1a34dc16f2474a90062aa814f0dfa5cae1e3d4 · sha256:5dc25a55b8dd66e5… · /containers/cna/affected/1

Affected products and versions

2 source assertions

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:b2b9345a058c3298aa99f120ea1a34dc16f2474a90062aa814f0dfa5cae1e3d4 · sha256:5dc25a55b8dd66e5… · /containers/cna/affected/0

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:b2b9345a058c3298aa99f120ea1a34dc16f2474a90062aa814f0dfa5cae1e3d4 · sha256:5dc25a55b8dd66e5… · /containers/cna/affected/1

Provider-owned CVSS observations

1 source assertion

{"metric":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"metric_type":"cvssV3_1"}

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:b2b9345a058c3298aa99f120ea1a34dc16f2474a90062aa814f0dfa5cae1e3d4 · sha256:5dc25a55b8dd66e5… · /containers/cna/metrics/0/cvssV3_1

Source references

6 source assertions

{"url":"https://git.kernel.org/stable/c/227ff4af00abc40b95123cc27ee8079069dcd8d7"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:b2b9345a058c3298aa99f120ea1a34dc16f2474a90062aa814f0dfa5cae1e3d4 · sha256:5dc25a55b8dd66e5… · /containers/cna/references/4

{"url":"https://git.kernel.org/stable/c/38353c26db28efd984f51d426eac2396d299cca7"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:b2b9345a058c3298aa99f120ea1a34dc16f2474a90062aa814f0dfa5cae1e3d4 · sha256:5dc25a55b8dd66e5… · /containers/cna/references/5

{"url":"https://git.kernel.org/stable/c/824a7672e3540962d5c77d4c6666254d7aa6f0b3"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:b2b9345a058c3298aa99f120ea1a34dc16f2474a90062aa814f0dfa5cae1e3d4 · sha256:5dc25a55b8dd66e5… · /containers/cna/references/3

{"url":"https://git.kernel.org/stable/c/8b00427317ba7b7ec91252b034009f638d0f311b"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:b2b9345a058c3298aa99f120ea1a34dc16f2474a90062aa814f0dfa5cae1e3d4 · sha256:5dc25a55b8dd66e5… · /containers/cna/references/1

{"url":"https://git.kernel.org/stable/c/c5dc39f8ae055520fd778b7fb0423f11586f15c4"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:b2b9345a058c3298aa99f120ea1a34dc16f2474a90062aa814f0dfa5cae1e3d4 · sha256:5dc25a55b8dd66e5… · /containers/cna/references/2

{"url":"https://git.kernel.org/stable/c/ebbb852ffbc952b95ddb7e3872b67b3e74c6da47"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:b2b9345a058c3298aa99f120ea1a34dc16f2474a90062aa814f0dfa5cae1e3d4 · sha256:5dc25a55b8dd66e5… · /containers/cna/references/0

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer