Executive brief
A vulnerability exists in the Linux kernel's pm8001 SCSI driver, which manages certain storage controllers. When a storage device is disconnected or unavailable, the system may incorrectly attempt to free the same memory twice. This can lead to a system crash or potentially allow an attacker to gain elevated privileges on the local system.
Technical details
A double-free vulnerability exists in drivers/scsi/pm8001/pm8001_sas.c within the pm8001_queue_command() function. The issue was introduced by a refactor that changed the function to return -ENODEV when a device is gone or the PHY is down. In this error path, the driver calls task_done(), which frees the SAS task, but then returns an error code to libsas. The libsas layer, receiving the error, assumes the task was never handled and attempts to free the task again. This results in a double-free/use-after-free condition. The fix ensures the function returns 0 in this scenario, signaling to the upper layer that the task has already been processed and freed.
Affected products
- Linux Linux Kernel 6.19 to 6.19.7, 6.13 to 6.18.17, 6.2 to 6.6.130, 6.7 to 6.12.77, 5.18 to 6.1.167
Timeline
- 2026-02-13: other: Patch submitted by developer
- 2026-03-25: advisory: NVD publication date
- 2026-03-25: patched: Fix merged into stable branches
References
- https://git.kernel.org/stable/c/227ff4af00abc40b95123cc27ee8079069dcd8d7
- https://git.kernel.org/stable/c/38353c26db28efd984f51d426eac2396d299cca7
- https://git.kernel.org/stable/c/824a7672e3540962d5c77d4c6666254d7aa6f0b3
- https://git.kernel.org/stable/c/8b00427317ba7b7ec91252b034009f638d0f311b
- https://git.kernel.org/stable/c/c5dc39f8ae055520fd778b7fb0423f11586f15c4
- https://git.kernel.org/stable/c/ebbb852ffbc952b95ddb7e3872b67b3e74c6da47