CVE-2026-23306 scsi: pm8001: Fix use-after-free in pm8001_queue_command()