The Linux kernel’s pm8001 SCSI driver contains a use‑after‑free bug that can trigger a double‑free when a target device is reported as offline or removed. The driver frees the underlying SAS task, returns -ENODEV to the caller, and libsas subsequently frees the same task again. This double‑free can corrupt kernel memory and cause a crash, resulting in a denial of service and loss of availability.

Any Linux distribution that runs a kernel containing the unpatched pm8001 driver is affected. The CNA does not provide a specific kernel version range, so all kernel releases older than the commit that introduced the fix are potentially vulnerable. No vendor‑specific distribution information is provided, so the impact applies broadly to Linux systems with pm8001 devices.

The flaw has a CVSS score of 7.8, indicating high severity, but the EPSS score is below 1 % and it is not listed in the CISA KEV catalog, implying low exploitation likelihood. Exploitation would require local or privileged access to manipulate a target’s state and issue a SCSI command that reaches the double‑free path. The attack vector is inferred from the need to control the device, likely through a local account with device administration rights. Overall risk is moderate, driven primarily by kernel crash potential rather than ease of attack.