Description
In the Linux kernel, the following vulnerability has been resolved:
scsi: pm8001: Fix use-after-free in pm8001_queue_command()
Commit e29c47fe8946 ("scsi: pm8001: Simplify pm8001_task_exec()") refactors
pm8001_queue_command(), however it introduces a potential cause of a double
free scenario when it changes the function to return -ENODEV in case of phy
down/device gone state.
In this path, pm8001_queue_command() updates task status and calls
task_done to indicate to upper layer that the task has been handled.
However, this also frees the underlying SAS task. A -ENODEV is then
returned to the caller. When libsas sas_ata_qc_issue() receives this error
value, it assumes the task wasn't handled/queued by LLDD and proceeds to
clean up and free the task again, resulting in a double free.
Since pm8001_queue_command() handles the SAS task in this case, it should
return 0 to the caller indicating that the task has been handled.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Linux | Linux | 5.18 | 6.1.167 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | linux | 6.19.8-1 | — |
| Debian 13 | linux | 6.12.85-1 | — |
| Debian 12 | linux | 6.1.170-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Nvidia-BlueField 24.04 LTS | linux-bluefield | 6.8.0-1028.33 | — |
| Ubuntu 25.10 | linux +8 | No fix yet | — |
| Ubuntu 24.04 LTS | linux | 6.8.0-136.136 | USN-8567-1 |
| Ubuntu 24.04 LTS | linux-aws | 6.8.0-1061.64 | USN-8595-2 |
| Ubuntu 24.04 LTS | linux-azure | 6.8.0-1063.71 | USN-8606-1 |
| Ubuntu 24.04 LTS | linux-azure-fde | 6.8.0-1062.69 | USN-8607-1 |
| Ubuntu 24.04 LTS | linux-gcp | 6.8.0-1064.72 | USN-8567-1 |
| Ubuntu 24.04 LTS | linux-gke | 6.8.0-1059.67 | USN-8567-1 |
| Ubuntu 24.04 LTS | linux-gkeop | 6.8.0-1046.50 | USN-8567-1 |
| Ubuntu 24.04 LTS | linux-ibm | 6.8.0-1061.62 | USN-8574-3 |
| Ubuntu 24.04 LTS | linux-lowlatency | 6.8.0-136.136.2 | USN-8574-2 |
| Ubuntu 24.04 LTS | linux-nvidia | 6.8.0-1059.62 | USN-8596-1 |
| Ubuntu 24.04 LTS | linux-nvidia-lowlatency | 6.8.0-1059.62.1 | USN-8596-1 |
| Ubuntu 24.04 LTS | linux-nvidia-tegra | 6.8.0-1030.31 | USN-8574-3 |
| Ubuntu 24.04 LTS | linux-oracle | 6.8.0-1058.61 | USN-8574-2 |
| Ubuntu 24.04 LTS | linux-raspi | 6.8.0-1061.65 | USN-8665-1 |
| Ubuntu 24.04 LTS | linux-riscv +27 | No fix yet | — |
| Ubuntu 24.04 LTS | linux-vmware | 6.8.0-1008.8 | — |
| Ubuntu 24.04 LTS | linux-xilinx | 6.8.0-1033.34 | USN-8574-3 |
| Ubuntu 22.04 LTS | linux-aws-6.8 | 6.8.0-1061.64~22.04.1 | USN-8595-3 |
| Ubuntu 22.04 LTS | linux-azure-6.8 | 6.8.0-1063.71~22.04.1 | USN-8606-1 |
| Ubuntu 22.04 LTS | linux-azure-fde-6.8 | 6.8.0-1062.69~22.04.1 | USN-8609-1 |
| Ubuntu 22.04 LTS | linux-gcp-6.8 | 6.8.0-1064.72~22.04.1 | USN-8567-1 |
| Ubuntu 22.04 LTS | linux-hwe-6.8 | 6.8.0-136.136~22.04.1 | USN-8619-1 |
| Ubuntu 22.04 LTS | linux-ibm-6.8 | 6.8.0-1061.62~22.04.1 | USN-8574-3 |
| Ubuntu 22.04 LTS | linux-lowlatency-hwe-6.8 | 6.8.0-136.136.2~22.04.1 | USN-8574-2 |
| Ubuntu 22.04 LTS | linux-nvidia-6.8 | 6.8.0-1059.62~22.04.1 | USN-8596-1 |
| Ubuntu 22.04 LTS | linux-oracle-6.8 | 6.8.0-1058.61~22.04.1 | USN-8595-1 |
| Ubuntu 22.04 LTS | linux-riscv +32 | No fix yet | — |
| Ubuntu 22.04 LTS | linux-riscv-6.8 | 6.8.0-136.136~22.04.3 | — |
| Ubuntu 20.04 LTS | linux-gke +28 | No fix yet | — |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | linux-gcp +14 | No fix yet | — |
| Ubuntu 16.04 LTS | linux-hwe-edge | No fix yet | — |
| Ubuntu Pro Realtime 24.04 LTS | linux-raspi-realtime | 6.8.0-2050.52 | USN-8665-1 |
| Ubuntu Pro Realtime 24.04 LTS | linux-realtime | 6.8.1-1056.57 | USN-8567-1 |
| Ubuntu Pro Realtime 24.04 LTS | linux-realtime-6.14 +1 | No fix yet | — |
| Ubuntu Pro Realtime 22.04 LTS | linux-realtime-6.8 | 6.8.1-1056.57~22.04.2 | USN-8567-1 |
| Ubuntu Pro FIPS-updates 24.04 LTS | linux-aws-fips | 6.8.0-1061.64+fips1 | USN-8595-3 |
| Ubuntu Pro FIPS-updates 24.04 LTS | linux-azure-fips | 6.8.0-1063.71+fips2 | USN-8608-1 |
| Ubuntu Pro FIPS-updates 24.04 LTS | linux-fips | 6.8.0-136.136+fips2 | USN-8574-2 |
| Ubuntu Pro FIPS-updates 24.04 LTS | linux-gcp-fips | 6.8.0-1064.72+fips1 | USN-8574-1 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | kernel-64kb +7 | 6.4.0-150700.53.55.1 | SUSE-SU-2026:2238-1 |
| SLES 15 SP7 | kernel-default-base | 6.4.0-150700.53.55.1.150700.17.33.1 | SUSE-SU-2026:2238-1 |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | kernel-64kb +8 | 6.12.0-160000.38.1 | SUSE-SU-2026:23902-1 |
| SLES for SAP 16.0 | kernel-default-base | 6.12.0-160000.38.1.160000.2.23 | SUSE-SU-2026:23902-1 |
| SLES 16.0 | kernel-64kb +8 | 6.12.0-160000.38.1 | SUSE-SU-2026:23902-1, SUSE-SU-2026:23897-1 |
| SLES 16.0 | kernel-default-base | 6.12.0-160000.38.1.160000.2.23 | SUSE-SU-2026:23902-1 |
| SLE Micro 6.2 | kernel-default-base | 6.12.0-160000.38.1.160000.2.23 | SUSE-SU-2026:23887-1 |
| SLE Micro 6.2 | kernel-rt +5 | 6.12.0-160000.38.1 | SUSE-SU-2026:23887-1, SUSE-SU-2026:23881-1 |
| SLE Live Patching 15 SP7 | kernel-default | 6.4.0-150700.53.55.1 | SUSE-SU-2026:2238-1 |
| SLE Live Patching 15 SP7 | kernel-livepatch-SLE15-SP7_Update_15 | 1-150700.15.3.1 | SUSE-SU-2026:2238-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 16.0 | kernel-default-base | 6.12.0-160000.38.1.160000.2.22 | openSUSE-SU-2026:21910-1 |
| openSUSE Leap 16.0 | kernel-rt +11 | 6.12.0-160000.38.1 | openSUSE-SU-2026:21910-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | kernel | 6.6.130.1-1 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | kernel-uek +34 | 6.12.0-204.92.4.2.el10uek | ELSA-2026-50372 |
Advisories 22
- WID-SEC-2026-0861 Linux Kernel: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 12, 2026
- USN-8574-3 linux-ibm, linux-ibm-6.8, linux-nvidia-tegra, linux-xilinx vulnerabilities Ubuntu Security Notices (USN) · Nov 9, 2026
- USN-8595-3 linux-aws-6.8, linux-aws-fips vulnerabilities Ubuntu Security Notices (USN) · Nov 9, 2026
- USN-8574-2 linux-fips, linux-lowlatency, linux-lowlatency-hwe-6.8, linux-oracle vulnerabilities Ubuntu Security Notices (USN) · Nov 9, 2026
- USN-8596-1 linux-nvidia, linux-nvidia-6.8, linux-nvidia-lowlatency vulnerabilities Ubuntu Security Notices (USN) · Nov 9, 2026
- USN-8665-1 linux-raspi, linux-raspi-realtime vulnerabilities Ubuntu Security Notices (USN) · Nov 9, 2026
- USN-8608-1 linux-azure-fips vulnerabilities Ubuntu Security Notices (USN) · Nov 9, 2026
- USN-8574-1 linux-gcp-fips vulnerabilities Ubuntu Security Notices (USN) · Nov 9, 2026
- USN-8595-2 linux-aws vulnerabilities Ubuntu Security Notices (USN) · Nov 9, 2026
- USN-8595-1 linux-oracle-6.8 vulnerabilities Ubuntu Security Notices (USN) · Nov 9, 2026
- USN-8567-1 linux, linux-gcp, linux-gcp-6.8, linux-gke, linux-gkeop, linux-realtime, linux-realtime-6.8 vulnerabilities Ubuntu Security Notices (USN) · Nov 7, 2026
- USN-8606-1 linux-azure, linux-azure-6.8 vulnerabilities Ubuntu Security Notices (USN) · Nov 7, 2026
- USN-8607-1 linux-azure-fde vulnerabilities Ubuntu Security Notices (USN) · Nov 7, 2026
- USN-8619-1 linux-hwe-6.8 vulnerabilities Ubuntu Security Notices (USN) · Nov 7, 2026
- USN-8609-1 linux-azure-fde-6.8 vulnerabilities Ubuntu Security Notices (USN) · Nov 7, 2026
- SUSE-SU-2026:23902-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Sep 30, 2026
- SUSE-SU-2026:23881-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Sep 30, 2026
- SUSE-SU-2026:23887-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Sep 30, 2026
- SUSE-SU-2026:23897-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Sep 30, 2026
- openSUSE-SU-2026:21910-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Sep 25, 2026
- ELSA-2026-50372 Important: Unbreakable Enterprise kernel security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Jul 2, 2026
- SUSE-SU-2026:2238-1 Security update for the Linux Kernel SUSE / openSUSE Security Updates · Jul 1, 2026
References
- https://git.kernel.org/stable/c/ebbb852ffbc952b95ddb7e3872b67b3e74c6da47
- https://git.kernel.org/stable/c/8b00427317ba7b7ec91252b034009f638d0f311b
- https://git.kernel.org/stable/c/c5dc39f8ae055520fd778b7fb0423f11586f15c4
- https://git.kernel.org/stable/c/824a7672e3540962d5c77d4c6666254d7aa6f0b3
- https://git.kernel.org/stable/c/227ff4af00abc40b95123cc27ee8079069dcd8d7
- https://git.kernel.org/stable/c/38353c26db28efd984f51d426eac2396d299cca7