CVE-2026-23306: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23306 is a use-after-free (double free) vulnerability in the Linux kernel's pm8001 SCSI driver, specifically within the pm8001_queue_command() function. It was introduced by commit e29c47fe8946 ("scsi: pm8001: Simplify pm8001_task_exec()") and disclosed on March 25, 2026. Affected kernel versions span from 5.18 through multiple stable branches, with fixes available in 6.1.167, 6.6.130, 6.12.77, 6.18.17, 6.19.7, and 7.0-rc2. It carries a CVSS v3.1 base score of 7.8 (High) (Red Hat Advisory, Feedly).

The root cause is a use-after-free condition (CWE-416) in pm8001_queue_command(). When a physical layer (phy) is down or a device is in a gone state, the function calls task_done to signal task completion to the upper layer — which frees the underlying SAS task — and then incorrectly returns -ENODEV to the caller. The libsas layer's sas_ata_qc_issue() interprets -ENODEV as meaning the task was never handled by the Low-Level Device Driver (LLDD) and proceeds to free the already-freed task, resulting in a double free. The fix requires pm8001_queue_command() to return 0 in this path, correctly indicating the task has been handled (Red Hat Advisory, Kernel Patch).

A local attacker with low privileges can trigger the double free by issuing SCSI commands when a pm8001 controller's physical layer is in a down or device-gone state. Successful exploitation can lead to arbitrary code execution with kernel privileges, resulting in full confidentiality, integrity, and availability compromise of the affected system. The scope is limited to the local machine, but kernel-level code execution could enable privilege escalation and lateral movement within a compromised environment (Red Hat Advisory).

Update the Linux kernel to a patched version corresponding to your branch:

• 6.1.x: upgrade to 6.1.167 or later
• 6.2–6.6: upgrade to 6.6.130 or later
• 6.7–6.12: upgrade to 6.12.77 or later
• 6.13–6.18: upgrade to 6.18.17 or later
• 6.19+: upgrade to 6.19.7 or later
• Azure Linux users: update to azl3_kernel_6.6.126.1-1 or later

As a temporary workaround, restrict local user access to SCSI command interfaces on systems with pm8001 controllers until patching is completed. Debian users should apply DSA-6238-1 or DSA-6243-1 as applicable, and SUSE users should apply SUSE-SU-2026:2217-1 or SUSE-SU-2026:2238-1 (Red Hat Advisory, Kernel Patch).

Red Hat has published a security advisory tracking this CVE and assigned a CVSS v3.1 score of 7.8 (High). Debian has issued security advisories DSA-6238-1 and DSA-6243-1 addressing this vulnerability in their kernel packages, and SUSE has released corresponding security updates. No notable independent researcher commentary or significant social media discussion has been observed (Red Hat Advisory, Debian Advisory).