HIGH Introduced in 5.10
hisi_sas DeviceLink Race
CVE-2026-80653
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
KernelScan AI3.9LOW
01Description
In the Linux kernel, the following vulnerability has been resolved: scsi: hisi_sas: Add slave_destroy interface for v3 hw WARNING is triggered when executing link reset of remote PHY and rmmod SAS driver simultaneously. Following is the WARNING log: WARNING: CPU: 61 PID: 21818 at drivers/base/core.c:1347 __device_links_no_driver+0xb4/0xc0 Call trace: __device_links_no_driver+0xb4/0xc0 device_links_driver_cleanup+0xb0/0xfc __device_release_driver+0x198/0x23c device_release_driver+0x38/0x50 bus_remove_device+0x130/0x140 device_del+0x184/0x434 __scsi_remove_device+0x118/0x150 scsi_remove_target+0x1bc/0x240 sas_rphy_remove+0x90/0x94 sas_rphy_delete+0x24/0x3c sas_destruct_devices+0x64/0xa0 [libsas] sas_revalidate_domain+0xe4/0x150 [libsas] process_one_work+0x1e0/0x46c worker_thread+0x15c/0x464 kthread+0x160/0x170 ret_from_fork+0x10/0x20 ---[ end trace 71e059eb58f85d4a ]--- During SAS phy up, link->status is set to DL_STATE_AVAILABLE in device_links_driver_bound, then this setting influences __device_links_no_driver() before driver rmmod and caused WARNING. Add the slave_destroy interface to make sure link is removed after flush workque.
02KernelScan AI Analysis
Risk summary
A race condition exists in the hisi_sas v3 hardware driver when a SAS PHY link reset coincides with driver module removal. The device link state can be set to available during phy-up while the driver is being torn down, triggering a kernel WARNING and potentially destabilizing the system. This requires local root privileges (module unload) and specific hardware (HiSilicon SAS controller).
Vulnerability analysis
A race condition in the hisi_sas v3 hardware driver can cause a kernel warning when a SAS PHY link reset happens at the same time the driver is being removed. During link bring-up, the driver creates a dependency between the storage device and the controller, but if the driver is unloaded while that link is still being established, the kernel detects an inconsistent state and emits a warning. The fix ensures the link is explicitly torn down only after any outstanding background work finishes, and changes how the link is managed so that cleanup happens safely. This only affects systems with HiSilicon SAS v3 controllers and requires root privileges to trigger.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 7.1 | 5.10 | 7.1.5 | 4867dba22929 |
| mainline | 5.10 | 7.2 | 67b85a88265d |
| 6.18 | 5.10 | 6.18.40 | cb414aff28e1 |