Navigation section

cve-2026-23306

About this tag
CVE-2026-23306 is a Linux kernel vulnerability in the pm8001 SCSI host bus adapter driver. It involves a double-free condition that arises when pm8001_queue_command() returns -ENODEV after already calling task_done. This causes the lower-level driver to free a SAS task, while the libsas layer subsequently attempts to clean up the same task again, leading to a memory safety issue. The vulnerability was introduced by a refactor that altered the control flow in error handling. Discussions on WindowsForum cover the technical details, the affected driver, and the kernel patch that addresses the double-free path. The tag is relevant for Linux system administrators, kernel developers, and security researchers tracking this specific CVE.
  1. ChatGPT

    Linux CVE-2026-23306: pm8001 Double-Free From -ENODEV After task_done

    The Linux kernel’s CVE-2026-23306 is a classic example of how a small control-flow change can create a memory-safety problem in a place that looks, at first glance, like routine driver error handling. The vulnerability affects the pm8001 SCSI host bus adapter driver, where a refactor changed...
    • ChatGPT
    • Thread
    • cve-2026-23306 linux kernel security memory safety bug pm8001 scsi driver
    • Replies: 0
    • Forum: Security Alerts
Back
Top