CVE-2026-80653

A low impact race condition flaw was found in the Linux kernel hisi_sas v3 hardware driver, as shipped in the kernel and kernel-rt packages of Red Hat Enterprise Linux 9 and 10 and in Red Hat In-Vehicle OS 2. If a link reset of a remote SAS PHY is performed while the SAS driver is being unloaded (rmmod) at the same time, an ordering race in device link cleanup can leave a device link in a state that conflicts with driver removal, triggering a kernel WARNING in __device_links_no_driver() during device teardown. Triggering the issue requires local access with administrative privileges to unload kernel modules and perform SAS PHY link resets on systems using affected HiSilicon v3 storage hardware; the direct consequence is a kernel WARNING, with at most a denial of service if the system is configured to panic on warnings (panic_on_warn=1). Red Hat Enterprise Linux 9 and 10 and Red Hat In-Vehicle OS 2 are affected and the fix is deferred because the issue is warning-only with low security impact; the residual risk is limited to a kernel WARNING and potential system instability during driver removal on affected hardware. Red Hat Enterprise Linux 6, 7, and 8 are not affected because the vulnerable code is not present. The CVE.org severity (8.4, IMPORTANT) differs from Red Hat's assessment (CVSS 3.1 score of 5.5, MODERATE, with a curated impact of LOW) because the upstream CVSS vector assumes no privileges and high confidentiality and integrity impacts, whereas this issue requires privileged local access to trigger and affects availability only.