Executive brief
The Linux kernel's HiSilicon SAS (Serial Attached SCSI) driver for v3 hardware has a race condition in device link management. When a remote PHY link reset occurs simultaneously with unloading the SAS driver, the driver fails to properly clean up device links, causing kernel warnings and potential system instability. This affects server systems using HiSilicon SAS controllers for storage connectivity.
Technical details
The vulnerability is a race condition (CWE-362) in the hisi_sas v3 hardware driver's device link handling. When a SAS PHY link reset executes concurrently with driver removal (rmmod), the device_links_driver_bound() function sets link->status to DL_STATE_AVAILABLE. However, when the driver is unloaded, __device_links_no_driver() encounters this stale link state, triggering a kernel WARNING in device_link cleanup. The fix adds a slave_destroy callback (hisi_sas_sdev_destroy) that explicitly removes device links during SCSI device teardown, and adds the DL_FLAG_STATELESS flag to prevent persistent link state tracking. The vulnerability requires local access and specific timing of concurrent operations; a patch is available in the Linux kernel stable tree.
Affected products
- Linux Linux kernel multiple versions (affected by race condition in hisi_sas v3 driver; patched in 2026-05-14 and later)
Timeline
- 2026-08-28: disclosed: Published to NVD
- 2026-05-14: patched: Fix committed upstream by Martin K. Petersen
- 2026-04-25: other: Initial patch submission by Yihang Li