EUVD-2026-67529
GHSA-5rhh-7836-grvh
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Race requires root for rmmod and SAS reset, so PR:H; precise timing window makes AC:H; local-only hardware path confirms AV:L.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
scsi: hisi_sas: Add slave_destroy interface for v3 hw
WARNING is triggered when executing link reset of remote PHY and rmmod SAS driver simultaneously. Following is the WARNING log:
WARNING: CPU: 61 PID: 21818 at drivers/base/core.c:1347 __device_links_no_driver+0xb4/0xc0 Call trace: __device_links_no_driver+0xb4/0xc0 device_links_driver_cleanup+0xb0/0xfc __device_release_driver+0x198/0x23c device_release_driver+0x38/0x50 bus_remove_device+0x130/0x140 device_del+0x184/0x434 __scsi_remove_device+0x118/0x150 scsi_remove_target+0x1bc/0x240 sas_rphy_remove+0x90/0x94 sas_rphy_delete+0x24/0x3c sas_destruct_devices+0x64/0xa0 [libsas] sas_revalidate_domain+0xe4/0x150 [libsas] process_one_work+0x1e0/0x46c worker_thread+0x15c/0x464 kthread+0x160/0x170 ret_from_fork+0x10/0x20 ---[ end trace 71e059eb58f85d4a ]---
During SAS phy up, link->status is set to DL_STATE_AVAILABLE in device_links_driver_bound, then this setting influences __device_links_no_driver() before driver rmmod and caused WARNING.
Add the slave_destroy interface to make sure link is removed after flush workque.
AnalysisAI
Race condition in the Linux kernel's hisi_sas v3 hardware driver triggers a kernel WARNING and potential memory corruption when SAS phy link reset and driver removal (rmmod) execute simultaneously. Specifically, during SAS phy bring-up, device_links_driver_bound sets the link status to DL_STATE_AVAILABLE, and a concurrent rmmod then causes __device_links_no_driver() to encounter an inconsistent device-link state. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) local access to a physical or virtual machine equipped with HiSilicon SAS v3 hardware (Huawei Kunpeng server platforms); (2) root-level privileges or CAP_SYS_ADMIN capability to both execute rmmod on the hisi_sas driver and issue SAS phy link reset commands; (3) precise race-window timing between the phy link reset workqueue operation and driver removal - a non-trivial coordination requirement. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD-assigned CVSS 3.1 score of 8.4 with PR:N is misleading and likely inflated for this vulnerability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the upstream kernel fixes merged to the stable trees, available at https://git.kernel.org/stable/c/cb414aff28e18e6f5cff9f87ea31376ed8af317b, https://git.kernel.org/stable/c/4867dba229292e13fc19ed865ec1839661952ff9, and https://git.kernel.org/stable/c/67b85a88265df19f049241d8c00571a5408f4eeb. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify systems running the hisi_sas v3 driver and confirm applicability to your infrastructure; within 7 days, schedule patching for affected systems during a maintenance window; within 30 days, complete deployment of the vendor patch and conduct stability validation across affected hardware.
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today