CVE-2026-80653: Linux Kernel SCSI HiSilicon SAS Vulnerability

CVE-2026-80653 Overview

CVE-2026-80653 is a race condition vulnerability in the Linux kernel's hisi_sas SCSI driver for v3 hardware. The flaw occurs when a link reset of a remote PHY runs concurrently with unloading the SAS driver via rmmod. This concurrent execution triggers a WARNING in __device_links_no_driver() at drivers/base/core.c:1347 because link->status is set to DL_STATE_AVAILABLE during SAS PHY up, which interferes with the driver cleanup path. The fix adds a slave_destroy interface for v3 hardware to ensure the device link is removed only after the workqueue is flushed.

Critical Impact
A local attacker with the ability to trigger SAS PHY link resets and driver removal can produce kernel-state inconsistencies affecting confidentiality, integrity, and availability of storage subsystems.

Affected Products

Linux kernel versions containing the hisi_sas v3 hardware driver prior to the patched commits
Systems using HiSilicon SAS v3 controllers for storage connectivity
Enterprise Linux distributions shipping the affected kernel revisions

Discovery Timeline

2026-08-28 - CVE-2026-80653 published to the National Vulnerability Database
2026-08-29 - Last updated in NVD database

Technical Details for CVE-2026-80653

Vulnerability Analysis

The vulnerability resides in the hisi_sas driver's handling of device link lifecycles for v3 hardware. When a SAS PHY comes up, the kernel sets link->status to DL_STATE_AVAILABLE inside device_links_driver_bound(). If a user simultaneously executes a remote PHY link reset and rmmod on the SAS driver, the driver removal path calls __device_links_no_driver() while the device link is still marked available. This state mismatch triggers a WARNING and unwinds through device_release_driver(), __scsi_remove_device(), sas_rphy_remove(), and sas_destruct_devices() in libsas.

The root issue is a race between the workqueue processing PHY events and the driver teardown path. Without proper synchronization, the driver core observes device links in an inconsistent state during module unload, leading to kernel warnings and potential follow-on corruption of the SCSI subsystem's device topology.

Root Cause

The hisi_sas v3 hardware driver lacked a slave_destroy interface. This absence meant device links established during PHY up events were not deterministically torn down before the driver's workqueue completed pending work. The libsas revalidation worker (sas_revalidate_domain) could run concurrently with rmmod, producing the observed WARNING in the driver core.

Attack Vector

Exploitation requires local access with privileges to load or unload kernel modules and to trigger SAS PHY link resets. An attacker with these capabilities can race the two operations to force the kernel into an inconsistent device-link state. While the primary observable effect is a kernel WARNING, race conditions in driver teardown paths [CWE-362] can produce broader consequences including use-after-free conditions in the SCSI device topology, storage subsystem instability, or a denial-of-service condition affecting SAS-attached storage.

The vulnerability mechanism is described in the upstream commit messages. See the Linux Kernel Commit Fix, Linux Kernel Commit Update, and Linux Kernel Code Change for the authoritative technical details.

Detection Methods for CVE-2026-80653

Indicators of Compromise

Kernel log entries containing WARNING: CPU: <n> PID: <n> at drivers/base/core.c:1347 __device_links_no_driver+0xb4/0xc0
Call traces referencing sas_destruct_devices, sas_revalidate_domain, sas_rphy_remove, or __scsi_remove_device during module unload
Unexpected SAS device disappearances or SCSI subsystem errors coinciding with hisi_sas_v3_hw module removal

Detection Strategies

Audit dmesg and persistent kernel logs (/var/log/kern.log, journalctl -k) for the specific WARNING signature tied to __device_links_no_driver
Monitor for concurrent execution of rmmod hisi_sas_v3_hw and SAS PHY reset operations issued through sysfs interfaces
Correlate kernel WARNING events with storage I/O errors on SAS-attached devices

Monitoring Recommendations

Ingest kernel logs from Linux hosts with HiSilicon SAS v3 controllers into a centralized logging platform for pattern-based alerting
Alert on any user-initiated rmmod targeting SCSI or SAS driver modules on production storage nodes
Track kernel module load and unload events using auditd rules on init_module and delete_module syscalls

How to Mitigate CVE-2026-80653

Immediate Actions Required

Inventory Linux systems running the hisi_sas v3 hardware driver, particularly hosts with HiSilicon SAS storage controllers
Apply the upstream kernel patches or update to a distribution kernel that includes the fix
Restrict CAP_SYS_MODULE and access to SAS PHY reset sysfs entries to trusted administrative accounts
Avoid concurrent execution of driver unload and PHY reset operations in operational runbooks

Patch Information

The fix adds a slave_destroy interface to the hisi_sas v3 hardware driver, ensuring the device link is removed after the workqueue is flushed. Apply the upstream commits referenced in the Linux Kernel Commit Fix, Linux Kernel Commit Update, and Linux Kernel Code Change. Consult your Linux distribution vendor for backported stable kernel releases.

Workarounds

Do not run rmmod against the hisi_sas v3 driver on production systems until the patched kernel is deployed
Enforce operational procedures that serialize PHY link reset operations and driver module management
Where feasible, blocklist unprivileged module unload capability using kernel lockdown mode or kernel.modules_disabled=1 after boot on production storage hosts

bash

# Disable further kernel module load/unload after boot on hardened hosts
sysctl -w kernel.modules_disabled=1

# Verify the currently loaded hisi_sas driver version
modinfo hisi_sas_v3_hw | grep -E 'filename|version|srcversion'

# Check kernel logs for the WARNING signature
journalctl -k | grep -E '__device_links_no_driver|sas_destruct_devices'