Key Information Summary Vulnerability Type: use-after-free bug Affected Component: in the driver Issue Description: - During the detach of a Marvell SAS/SATA controller, the original code calls in to cancel the delayed work item . - If is already running, may fail to cancel it, leading to a use-after-free scenario: frees , while is still executing and attempts to access the already-freed . Fix: - Replace with to ensure the delayed work item is properly canceled and any running instance completes before is freed. Discovery Method: Static analysis Related Commit: ("[SCSI] mv8as: add support for 94xx; layout change; bug fixes") Signers: Duoming Zhou, Martin K. Petersen, Sasha Levin