The Linux kernel's ISCI SCSI driver had a use-after-free vulnerability in its device removal path. The completion tasklet, initialized in isci_host_alloc() and scheduled by interrupt handlers, was not killed after the controller stopped, allowing interrupts to requeue the tasklet. This caused a race condition where the tasklet callback could access freed memory (ihost and ihost->smu_registers) after the host lifetime ended. The fix involves killing the completion tasklet only after wait_for_stop() returns, ensuring no further IRQ-driven scheduling can occur, thus preventing the use-after-free condition. This approach mirrors a previous fix for a similar issue in the aic94xx driver.

Exploitation of this vulnerability could cause kernel memory corruption due to use-after-free, potentially leading to system instability or crashes. There is no indication of known exploits in the wild. The vulnerability affects the Linux kernel's ISCI SCSI driver during device removal or unload operations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid unloading or removing ISCI devices in environments where this vulnerability could be triggered. Monitor vendor channels for updates and apply the fix once released.