CVE-2026-80653

A flaw was found in the Linux kernel's hisi_sas driver. A local attacker or privileged user could trigger a kernel warning by simultaneously performing a link reset on a remote physical layer (PHY) device and removing the SAS driver. This race condition can lead to system instability or a denial of service (DoS).

A low impact race condition flaw was found in the Linux kernel hisi_sas v3 hardware driver, as shipped in the kernel and kernel-rt packages of Red Hat Enterprise Linux 9 and 10 and in Red Hat In-Vehicle OS 2. If a link reset of a remote SAS PHY is performed while the SAS driver is being unloaded (rmmod) at the same time, an ordering race in device link cleanup can leave a device link in a state that conflicts with driver removal, triggering a kernel WARNING in __device_links_no_driver() during device teardown. Triggering the issue requires local access with administrative privileges to unload kernel modules and perform SAS PHY link resets on systems using affected HiSilicon v3 storage hardware; the direct consequence is a kernel WARNING, with at most a denial of service if the system is configured to panic on warnings (panic_on_warn=1). Red Hat Enterprise Linux 9 and 10 and Red Hat In-Vehicle OS 2 are affected and the fix is deferred because the issue is warning-only with low security impact; the residual risk is limited to a kernel WARNING and potential system instability during driver removal on affected hardware. Red Hat Enterprise Linux 6, 7, and 8 are not affected because the vulnerable code is not present. The CVE.org severity (8.4, IMPORTANT) differs from Red Hat's assessment (CVSS 3.1 score of 5.5, MODERATE, with a curated impact of LOW) because the upstream CVSS vector assumes no privileges and high confidentiality and integrity impacts, whereas this issue requires privileged local access to trigger and affects availability only.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.