Executive brief
The Linux kernel's hisi_sas SCSI driver contains a race condition in its slot cleanup routine that can cause the system to crash with a NULL pointer exception. This affects enterprise servers and storage systems that use HiSilicon SAS host adapters. An attacker with local access could trigger this condition to cause a denial of service, resulting in system downtime and potential data loss.
Technical details
The vulnerability is a use-after-free / race condition in the hisi_sas driver's slot completion handler (slot_complete_v3_hw). When freeing device slots, the code traverses sas_dev.list without holding the sas_dev lock, while concurrent error handling threads may be modifying the same list via list_del_init(). This creates a classic concurrent list traversal vulnerability. The attack vector is local; an attacker can trigger error conditions (e.g., SCSI errors, task aborts) to initiate the race, causing a NULL pointer dereference in dereg_device_v3_hw(). The fix involves acquiring the sas_dev lock before traversing sas_dev.list members in both dereg_device_v3_hw() and hisi_sas_release_tasks() to serialize access.
Affected products
- Linux Linux Kernel versions prior to fix containing hisi_sas driver
Timeline
- 2025-10-07: disclosed: CVE-2023-53627 published to NVD
- patched: Fix involves acquiring sas_dev lock during list traversal in slot completion and device deregistration paths