Linux Kernel Vulnerability in PM8001 Driver by Linux Foundation

CVE-2026-23306

What is CVE-2026-23306?

The Linux kernel's PM8001 driver contains a use-after-free vulnerability due to improper handling of task statuses. Following a refactor in pm8001_queue_command(), an error handling path was introduced that leads to a double free scenario. When a task operation fails due to a device being offline, the function mistakenly indicates that the task was processed and frees the associated resources. This can result in a crash or unpredictable behavior if the task is freed again by the caller, highlighting the need for careful resource management in kernel-level code.

References