Skip to main content

Linux hisi_sas EUVDEUVD-2026-67529

| CVE-2026-80653 HIGH
2026-08-28 Linux GHSA-5rhh-7836-grvh
Information Disclosure Linux
High
Disputed · 8.4 Vendor: Linux
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Gain root on Kunpeng/HiSilicon server
  2. Delivery
    Initiate SAS remote PHY link reset
  3. Exploit
    Concurrently execute rmmod hisi_sas
  4. Execution
    Race hits DL_STATE_AVAILABLE in __device_links_no_driver
  5. Persist
    Kernel WARNING fires, device-link state corrupted
  6. Impact
    Potential memory corruption or system instability

Vulnerability Assessment

Exploitation Conditions

Exploitation requires: (1) local access to a physical or virtual machine equipped with HiSilicon SAS v3 hardware (Huawei Kunpeng server platforms); (2) root-level privileges or CAP_SYS_ADMIN capability to both execute rmmod on the hisi_sas driver and issue SAS phy link reset commands; (3) precise race-window timing between the phy link reset workqueue operation and driver removal - a non-trivial coordination requirement. The limiting factors are significant: no remote attack path exists (AV:L), the hardware dependency restricts the exposed population to HiSilicon SAS v3 deployments, and root is required for both triggering operations. The NVD-assigned PR:N does not reflect these actual prerequisites.
Impact

The NVD-assigned CVSS 3.1 score of 8.4 with PR:N is misleading and likely inflated for this vulnerability. Triggering the race requires simultaneously executing a SAS phy link reset and rmmod of the kernel driver - both operations require root (CAP_SYS_ADMIN or equivalent) on the local system. The PR:N designation does not align with these real-world requirements and should be treated with skepticism. AC:H is more appropriate than AC:L given the precise timing required to hit the race window. EPSS at 0.17% (6th percentile) correctly signals very low exploitation probability. The flaw is not in CISA KEV. The hisi_sas driver is HiSilicon-specific hardware, limiting affected deployments to Kunpeng/Huawei-based servers. Realistic risk is significantly lower than the raw CVSS score implies: exploitation requires local root access, specific HiSilicon SAS v3 hardware, and precise race-window timing - this is far from a general-purpose privilege escalation vector. The kernel WARNING alone confirms the buggy state but the actual exploitability to achieve C:H/I:H/A:H impacts is unconfirmed and likely difficult.
Exploit ScenarioDerived

A local attacker or administrator on a Huawei/HiSilicon Kunpeng server with root access triggers a remote PHY link reset through SAS management interfaces while simultaneously unloading the hisi_sas kernel module via rmmod. The precise timing of these two operations causes the device-link state machine to reach an inconsistent state in __device_links_no_driver(), potentially corrupting kernel memory structures associated with device links. No public proof-of-concept exploit exists; successful exploitation to achieve code execution would require additional primitives beyond triggering the race.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Aug 29, 2026

Race condition in the Linux kernel's hisi_sas v3 hardware driver triggers a kernel WARNING and potential memory corruption when SAS phy link reset and driver removal (rmmod) execute simultaneously. Specifically, during SAS phy bring-up, device_links_driver_bound sets the link status to DL_STATE_AVAILABLE, and a concurrent rmmod then causes __device_links_no_driver() to encounter an inconsistent device-link state. No public exploit exists and EPSS sits at 0.17% (6th percentile), reflecting this is a hardware-specific, privilege-intensive, timing-dependent flaw with very low exploitation likelihood in practice.

RemediationAI

Apply the upstream kernel fixes merged to the stable trees, available at https://git.kernel.org/stable/c/cb414aff28e18e6f5cff9f87ea31376ed8af317b, https://git.kernel.org/stable/c/4867dba229292e13fc19ed865ec1839661952ff9, and https://git.kernel.org/stable/c/67b85a88265df19f049241d8c00571a5408f4eeb. Administrators should upgrade to Linux 7.2, 7.1.5, or 6.18.40 as appropriate to their kernel branch. For systems where immediate kernel upgrade is not feasible, a practical compensating control is to avoid performing SAS phy link resets (e.g. via sas_phy_reset or similar management operations) while the hisi_sas module is being removed - operationally, serialize driver maintenance windows to prevent concurrent phy and module lifecycle operations. Blacklisting the hisi_sas module entirely disables HiSilicon SAS functionality and is only viable if that storage path is non-critical. No vendor advisory URL beyond the upstream kernel stable commits and NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-80653) has been identified.

Affected VersionsENISA

Linux patch: 0
Linux 5.10
Linux 16fd4a7c5917097e9a3da03b39a92381eee40724 <67b85a88265df19f049241d8c00571a5408f4eeb
Linux 16fd4a7c5917097e9a3da03b39a92381eee40724 <4867dba229292e13fc19ed865ec1839661952ff9
Linux patch: 7.1.5
Linux patch: 6.18.40
Linux patch: 7.2
Linux 16fd4a7c5917097e9a3da03b39a92381eee40724 <cb414aff28e18e6f5cff9f87ea31376ed8af317b

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The vulnerability resides in the hisi_sas (HiSilicon Serial Attached SCSI) driver for v3 hardware, part of the Linux kernel's SCSI subsystem (CPE: cpe:2.3:a:linux:linux). The root cause is a missing slave_destroy interface in the v3 driver path, which would normally ensure that device links established during SAS phy up are properly torn down before the workqueue is flushed on driver removal. Without this interface, when device_links_driver_bound marks a link as DL_STATE_AVAILABLE during phy up, a concurrent rmmod followed by bus_remove_device/device_del walks into __device_links_no_driver() while the link is still in an active state, producing a kernel WARN_ON at drivers/base/core.c:1347. No CWE is formally assigned, but this is a classic TOCTOU race condition (CWE-367) in kernel device lifecycle management, with potential consequences extending to use-after-free or reference-count corruption in the device-link structures.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Low–High)
Vendor (Linux) PRIMARY 8.4 HIGH
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 6.4 MEDIUM

Race requires root for rmmod and SAS reset, so PR:H; precise timing window makes AC:H; local-only hardware path confirms AV:L.

3.1 AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat 5.5 LOW

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
CVSS changed
Aug 29, 2026 - 07:22 NVD
8.4 (HIGH)
Patch available
Aug 28, 2026 - 09:02 EUVD
CVE Published
Aug 28, 2026 - 06:49 cve.org
HIGH 8.4
CVE Published
Aug 28, 2026 - 06:49 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

scsi: hisi_sas: Add slave_destroy interface for v3 hw

WARNING is triggered when executing link reset of remote PHY and rmmod SAS driver simultaneously. Following is the WARNING log:

WARNING: CPU: 61 PID: 21818 at drivers/base/core.c:1347 __device_links_no_driver+0xb4/0xc0 Call trace: __device_links_no_driver+0xb4/0xc0 device_links_driver_cleanup+0xb0/0xfc __device_release_driver+0x198/0x23c device_release_driver+0x38/0x50 bus_remove_device+0x130/0x140 device_del+0x184/0x434 __scsi_remove_device+0x118/0x150 scsi_remove_target+0x1bc/0x240 sas_rphy_remove+0x90/0x94 sas_rphy_delete+0x24/0x3c sas_destruct_devices+0x64/0xa0 [libsas] sas_revalidate_domain+0xe4/0x150 [libsas] process_one_work+0x1e0/0x46c worker_thread+0x15c/0x464 kthread+0x160/0x170 ret_from_fork+0x10/0x20 ---[ end trace 71e059eb58f85d4a ]---

During SAS phy up, link->status is set to DL_STATE_AVAILABLE in device_links_driver_bound, then this setting influences __device_links_no_driver() before driver rmmod and caused WARNING.

Add the slave_destroy interface to make sure link is removed after flush workque.

Executive ViewAI

Why It Matters

CVE-2026-80653 affects the Linux kernel's hisi_sas v3 hardware driver and introduces a race condition that could corrupt kernel memory on affected enterprise systems. While a patch is available, this vulnerability requires specific hardware, precise timing alignment, and elevated privileges-resulting in minimal real-world exploitation risk, but potential system instability for affected organizations.

Business Impact: Medium
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.2%
Top 94% exploitable
Prevalence
Low
HiSilicon SAS v3 controllers limited to Huawei Kunpeng servers
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
Medium

Priority Score

42
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +42
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-80653 ADVISORY https://ubuntu.com/security/notices/USN-8887-1 ADVISORY https://ubuntu.com/security/notices/USN-8888-1 ADVISORY https://ubuntu.com/security/notices/USN-8889-1 ADVISORY https://vuldb.com/vuln/396594 REF https://git.kernel.org/stable/c/4867dba229292e13fc19ed865ec1839661952ff9 REF https://git.kernel.org/stable/c/67b85a88265df19f049241d8c00571a5408f4eeb REF https://git.kernel.org/stable/c/c305853027c04f34435ca4edace772709d70a4fe REF https://git.kernel.org/stable/c/cb414aff28e18e6f5cff9f87ea31376ed8af317b REF https://git.kernel.org/stable/c/d664252d414aae17066a2831fe7bfd8f0e27b018 REF https://git.kernel.org/stable/c/f8bf667891e92fbe13d02671d4637775ab3118f0

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy