Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
In the Linux kernel, the following vulnerability has been resolved: scsi: pm8001: Fix use-after-free in pm8001_queue_command() Commit e29c47fe8946 ("scsi: pm8001: Simplify pm8001_task_exec()") refactors pm8001_queue_command(), however it introduces a potential cause of a double free scenario when it changes the function to return -ENODEV in case of phy down/device gone state. In this path, pm8001_queue_command() updates task status and calls task_done to indicate to upper layer that the task has been handled. However, this also frees the underlying SAS task. A -ENODEV is then returned to the caller. When libsas sas_ata_qc_issue() receives this error value, it assumes the task wasn't handled/queued by LLDD and proceeds to clean up and free the task again, resulting in a double free. Since pm8001_queue_command() handles the SAS task in this case, it should return 0 to the caller indicating that the task has been handled.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
| Date | Total | Labels |
|---|
| 2026-03-25 | 2 | Patch2 |
| 2026-03-26 | 1 | Disclosure1 |
| 2026-03-31 | 1 | General1 |
CVE-2026-23306 In the Linux kernel, the following vulnerability has been resolved: scsi: pm8001: Fix use-after-free in pm8001_queue_command() Commit e29c47fe8946 ("scsi: pm8001: S… https://www.cve.org/CVERecord?id=CVE-2026-23306
Post summary
CVE-2026-23306 is a use‑after‑free bug in the Linux kernel’s pm8001 SCSI driver that has been fixed by a specific commit, providing a patch for affected systems.
⚡ New CVE Alert: CVE-2026-23306 🚨 Risk Level: Unknown 🧩 Affects: Multiple / Unspecified Products Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-23306 #CVE-2026-23306 #CVE #CyberSecurity #InfoSec https://t.co/yeEPzZ4QQR
Post summary
A brief CVE alert with no actionable details, technical data, or mitigation information.
🧨 Double-free bugs in pm8001 after -ENODEV? Linux refactors: where “minor control-flow tweak” becomes “boom, memory safety.” This is why QA matters. https://windowsforum.com/threads/linux-cve-2026-23306-pm8001-double-free-from-enodev-after-task_done.407374/ #LinuxKernelSecurity #Pm8001ScsiDriver #Cve202623306 #MemorySafetyBug https://t.co/Hj9fhOSaZl
Post summary
The post announces a double‑free vulnerability (CVE‑2026‑23306) in the pm8001 SCSI driver, describing its technical nature but providing no proof‑of‑concept, exploit, or patch details.
🚨*CVE* CVE-2026-23306 In the Linux kernel, the following vulnerability has been resolved: scsi: pm8001: Fix use-after-free in pm8001_queue_command() Commit e29c47fe8946 ("scsi: pm8001: S… https://www.cve.org/CVERecord?id=CVE-2026-23306 ----- Traducción: CVE-2026-23306 En … http://infoflow.cloud`
Post summary
CVE‑2026‑23306 is a use‑after‑free bug in the Linux kernel’s pm8001 SCSI driver that has been patched; no PoC, exploit code, or active exploitation is mentioned.
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| OS | linux | linux_kernel | - | - | - |
| OS | linux | linux_kernel | 7.0 | - | - |