# CVE-2026-80653: scsi: hisi_sas: Add slave_destroy interface for v3 hw

CVE-2026-80653 is fixed in linux on 1 platform, first by DEBIAN-CVE-2026-80653, released August 29, 2026. It is not reported as exploited. Patch Radar priority: Urgent.

- Web page: https://patchblox.com/security/cve/CVE-2026-80653
- Priority: Urgent
- CVSS: 9.8 (Critical)
- EPSS: 0.0018
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Aug 28, 2026
- Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-80653

## Description

In the Linux kernel, the following vulnerability has been resolved:  scsi: hisi_sas: Add slave_destroy interface for v3 hw  WARNING is triggered when executing link reset of remote PHY and rmmod SAS driver simultaneously. Following is the WARNING log:  WARNING: CPU: 61 PID: 21818 at drivers/base/core.c:1347 __device_links_no_driver+0xb4/0xc0  Call trace:   __device_links_no_driver+0xb4/0xc0   device_links_driver_cleanup+0xb0/0xfc   __device_release_driver+0x198/0x23c   device_release_driver+0x38/0x50   bus_remove_device+0x130/0x140   device_del+0x184/0x434   __scsi_remove_device+0x118/0x150   scsi_remove_target+0x1bc/0x240   sas_rphy_remove+0x90/0x94   sas_rphy_delete+0x24/0x3c   sas_destruct_devices+0x64/0xa0 [libsas]   sas_revalidate_domain+0xe4/0x150 [libsas]   process_one_work+0x1e0/0x46c   worker_thread+0x15c/0x464   kthread+0x160/0x170   ret_from_fork+0x10/0x20  ---[ end trace 71e059eb58f85d4a ]---  During SAS phy up, link->status is set to DL_STATE_AVAILABLE in device_links_driver_bound, then this setting influences __device_links_no_driver() before driver rmmod and caused WARNING.  Add the slave_destroy interface to make sure link is removed after flush workque.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 13.5 (trixie) | 6.12.115-2 | [DEBIAN-CVE-2026-80653](https://patchblox.com/security/data/fix/linux/debian-cve-2026-80653.md) | Aug 29, 2026 |
| Linux | linux Debian 14 | 7.1.5-1 | [DEBIAN-CVE-2026-80653](https://patchblox.com/security/data/fix/linux/debian-cve-2026-80653.md) | Aug 29, 2026 |

---

Data as of 2026-11-08T06:59:42Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.