CVE-2026-80653

A race condition in the Linux kernel's hisi_sas driver for HiSilicon SAS v3 controllers causes a kernel WARNING because the driver lacks a slave_destroy callback, allowing device links to be removed out of order when the SAS driver is unloaded. It is triggered when a remote PHY link reset runs concurrently with removal of the SAS driver module (rmmod), with the warning raised in the device-links cleanup path (device_links_driver_cleanup) while libsas destroys SAS rphy devices. A local attacker or administrator who times these operations can trigger the warning, potentially disrupting or crashing the system (denial of service); the CVSS 3.1 score of 8.4 reflects potential high confidentiality, integrity, and availability impact, though a local attack vector is required. Only Linux systems using HiSilicon SAS v3 controllers — found primarily in Huawei Kunpeng/TaiShan ARM servers — are affected. No public proof-of-concept exists, the flaw is not in CISA's KEV catalog, and EPSS estimates only a 0.1% probability of exploitation within 30 days.

What to do: Apply a Linux kernel update that includes the hisi_sas v3 hw slave_destroy patch (via stable or vendor-distribution kernel updates once available). Until patched, avoid unloading the hisi_sas module (rmmod) while SAS link resets may be running, e.g., quiesce SAS activity before module removal. Confirm applicability by checking whether systems use HiSilicon SAS v3 controllers (e.g., via lspci/lsscsi).