Description

In the Linux kernel, the following vulnerability has been resolved: scsi: hisi_sas: Add slave_destroy interface for v3 hw WARNING is triggered when executing link reset of remote PHY and rmmod SAS driver simultaneously. Following is the WARNING log: WARNING: CPU: 61 PID: 21818 at drivers/base/core.c:1347 __device_links_no_driver+0xb4/0xc0 Call trace: __device_links_no_driver+0xb4/0xc0 device_links_driver_cleanup+0xb0/0xfc __device_release_driver+0x198/0x23c device_release_driver+0x38/0x50 bus_remove_device+0x130/0x140 device_del+0x184/0x434 __scsi_remove_device+0x118/0x150 scsi_remove_target+0x1bc/0x240 sas_rphy_remove+0x90/0x94 sas_rphy_delete+0x24/0x3c sas_destruct_devices+0x64/0xa0 [libsas] sas_revalidate_domain+0xe4/0x150 [libsas] process_one_work+0x1e0/0x46c worker_thread+0x15c/0x464 kthread+0x160/0x170 ret_from_fork+0x10/0x20 ---[ end trace 71e059eb58f85d4a ]--- During SAS phy up, link->status is set to DL_STATE_AVAILABLE in device_links_driver_bound, then this setting influences __device_links_no_driver() before driver rmmod and caused WARNING. Add the slave_destroy interface to make sure link is removed after flush workque.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.4",
  "pubDate": "2026-08-28T08:16:50.350Z",
  "pubdate": "2026-08-28T08:16:50.350Z",
  "executiveSummary": "A kernel-level race condition vulnerability exists in the Linux kernel's hisi_sas driver for v3 hardware.\nThe vulnerability is triggered by a concurrency conflict between a SAS link reset event and the removal (rmmod) of the SAS driver, leading to an inconsistent state in the kernel's device link management subsystem.\nThis manifests as a WARNING generated by the kernel at drivers/base/core.c:1347, specifically within the __device_links_no_driver function.\nThe flaw stems from improper handling of device link states during the teardown of SAS remote PHY devices, where a link remains in a state that conflicts with the driver unloading process.\nWhile the current manifestation is a kernel WARNING, such race conditions in the device driver model can potentially lead to kernel instability, use-after-free vulnerabilities, or system crashes under specific high-load conditions.\nExploitation requires local, privileged access to the system to trigger the concurrent execution of driver removal and device link cleanup tasks.",
  "technicalDetails": "The root cause of this vulnerability lies in the race condition occurring within the device link lifecycle management when handling remote PHY devices in the hisi_sas v3 hardware driver.\nDuring the SAS PHY UP process, the driver establishes device links that transition into the DL_STATE_AVAILABLE state via the device_links_driver_bound function. When an administrator initiates an rmmod operation to remove the SAS driver while a link reset is concurrently active, the kernel's device management framework attempts to tear down these links.\nThe stack trace highlights that the trigger occurs within __device_links_no_driver, called during the process of removing the SCSI device. Specifically, the sequence of events is as follows: sas_revalidate_domain invokes sas_destruct_devices, which proceeds to call sas_rphy_delete, leading to scsi_remove_target and eventually device_del.\nThe device_del operation initiates the removal of the device driver via __device_release_driver. Because the link state remains marked as DL_STATE_AVAILABLE, the kernel's internal device link verification logic detects an illegal or unexpected state during the cleanup of driver references, triggering the kernel warning at drivers/base/core.c.\nThe lack of a specific slave_destroy interface in the v3 hardware implementation prevents the driver from explicitly cleaning up the device link relationship before the workqueue management system processes the device removal. Consequently, the kernel attempts to finalize driver removal while the device link is still actively bound to a state that requires a driver, resulting in the observed WARNING.\nIn terms of attack flow, a malicious or unprivileged user with the ability to influence kernel module management or trigger hardware reset sequences could theoretically exacerbate these race conditions to force an unstable kernel state. The post-exploitation impact involves potential kernel panics or forced system reboots, and the vulnerability persists until the driver interface correctly manages the lifecycle of the link during device destruction.\nThe vulnerable component is the hisi_sas driver, specifically the logic governing v3 hardware interaction and device link cleanup during concurrent event handling."
}