EUVD-2026-80615
GHSA-jq5h-3g7m-2crv
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Probe-time error path not attacker-triggerable (AC:H, PR:H for HBA/driver control), no data exposure (C:N/I:N), at most a warning/handler leak (A:L).
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
scsi: pm8001: Use rollback index when freeing MSI-X vectors
pm8001_request_msix() unwinds previously registered handlers with free_irq() when request_irq() fails. The rollback loop uses the failing index i for every iteration instead of the already registered vector index j.
That passes the wrong IRQ/dev_id pair to free_irq() and leaves the earlier handlers installed. Use j for both pci_irq_vector() and the matching irq_vector entry in the rollback loop.
AnalysisAI
Linux kernel pm8001 SAS/SATA HBA driver contains an error-path cleanup bug that can leave MSI-X interrupt handlers installed when request_irq() fails during driver initialization, because the rollback loop uses the failing index instead of the previously registered vector index. Systems with a PMC-Sierra/Adaptec 8001-series controller bound to the pm8001/pm80xx driver and kernel versions from 4.11 up to the fixed releases are affected. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the pm8001/pm80xx driver to be bound to a physical PMC-Sierra/Adaptec 8001 SAS/SATA HBA, and the flawed rollback path executes only if request_irq() fails while registering MSI-X handlers during driver probe/initialization. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a driver error-path cleanup bug, not an attacker-reachable memory-safety flaw, and the vendor CVSS of 7.8 (AV:L/AC:L/PR:L/C:H/I:H/A:H) is wildly over-scored. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patches are available in Linux stable releases 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.110, 6.18.51, 7.2.5, and 7.3-rc2; update to one of these or later. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all systems using PMC-Sierra/Adaptec 8001-series controllers bound to the pm8001 or pm80xx driver and kernel versions from 4.11 up to the fixed releases; confirm current kernel and driver versions, and flag any production servers that cannot be rebooted quickly. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today