scsi: hisi_sas: Add slave_destroy interface for v3 hw
CVE-2026-80653 · published 28 Aug 2026
How serious is it
- Severity: high, CVSS score 8.4 out of 10.
- No exploit prediction (EPSS) score yet.
- Not on the CISA list of exploited vulnerabilities.
- No public exploit in Exploit-DB.
Is your app affected by CVE-2026-80653?
Paste this prompt into Claude Code, Cursor or any AI coding tool: it runs a free Shippable scan of your project and fixes what it finds. Built with Lovable, Bolt or v0? Scan your live app. Or upload your package file.
Who is affected
- Linux Linux: 16fd4a7c5917097e9a3da03b39a92381eee40724 to < c305853027c04f34435ca4edace772709d70a4fe, 16fd4a7c5917097e9a3da03b39a92381eee40724 to < f8bf667891e92fbe13d02671d4637775ab3118f0, 16fd4a7c5917097e9a3da03b39a92381eee40724 to < cb414aff28e18e6f5cff9f87ea31376ed8af317b, 16fd4a7c5917097e9a3da03b39a92381eee40724 to < 4867dba229292e13fc19ed865ec1839661952ff9
- Linux Linux: 5.10
How to check
- Find out whether you run the affected product and which version, then compare it with the versions above.
How to fix
Copies a prompt for Claude Code, Cursor or Codex that asks it to check whether you run this product.
- Apply the vendor's update or mitigation from the references below. If there is none yet, limit exposure of the affected service until there is.
- If a vulnerable version was live, check your logs and rotate the secrets that server could read.
The advisory
In the Linux kernel, the following vulnerability has been resolved:
scsi: hisi_sas: Add slave_destroy interface for v3 hw
WARNING is triggered when executing link reset of remote PHY and rmmod
SAS driver simultaneously. Following is the WARNING log:
WARNING: CPU: 61 PID: 21818 at drivers/base/core.c:1347 __device_links_no_driver+0xb4/0xc0
Call trace:
__device_links_no_driver+0xb4/0xc0
device_links_driver_cleanup+0xb0/0xfc
__device_release_driver+0x198/0x23c
device_release_driver+0x38/0x50
bus_remove_device+0x130/0x140
device_del+0x184/0x434
__scsi_remove_device+0x118/0x150
scsi_remove_target+0x1bc/0x240
sas_rphy_remove+0x90/0x94
sas_rphy_delete+0x24/0x3c
sas_destruct_devices+0x64/0xa0 [libsas]
sas_revalidate_domain+0xe4/0x150 [libsas]
process_one_work+0x1e0/0x46c
worker_thread+0x15c/0x464
kthread+0x160/0x170
ret_from_fork+0x10/0x20
---[ end trace 71e059eb58f85d4a ]---
During SAS phy up, link->status is set to DL_STATE_AVAILABLE in
device_links_driver_bound, then this setting influences
__device_links_no_driver() before driver rmmod and caused WARNING.
Add the slave_destroy interface to make sure link is removed after flush
workque.
Check your whole app
Dependencies are only half of it. Free and read-only: before you push, run npx shippable-dev scan localhost:3000 in your project folder, no account needed. For your live app, you prove it's yours with a one-line tag first.
References
- git.kernel.org/stable/c/c305853027c04f34435ca4edace772709d70a4fe
- git.kernel.org/stable/c/f8bf667891e92fbe13d02671d4637775ab3118f0
- git.kernel.org/stable/c/cb414aff28e18e6f5cff9f87ea31376ed8af317b
- git.kernel.org/stable/c/4867dba229292e13fc19ed865ec1839661952ff9
- git.kernel.org/stable/c/67b85a88265df19f049241d8c00571a5408f4eeb
Merged from CVE List. Last updated 26 Oct 2026. All vulnerabilities · RSS · JSON