The vulnerability occurs in the Linux kernel’s scsi hisi_sas driver when the user_scan() routine invokes sas_user_scan() for a non‑existent channel. The driver incorrectly proceeds to scan channel 1, producing a NULL pointer dereference that triggers a kernel Oops. This results in an unhandled kernel panic, which may cause a system reboot or loss of service.

All Linux kernel installations that include the hisi_sas SCSI driver are potentially impacted. The vendor list indicates Linux:Linux for both entries, and no specific version range is supplied, implying that any kernel before the fix is vulnerable. The patch resolving the issue is present in subsequent kernel releases.

The vulnerability leads to a local denial of service through a kernel crash caused by a NULL pointer dereference in the hisi_sas scsi driver. Based on the description, it is inferred that an attacker would need elevated privileges or local access to write to the user_scan sysfs attribute to trigger the flaw, potentially forcing a reboot. The CVSS score of 5.5 indicates medium severity, while the EPSS is not available and the vulnerability is not in the CISA KEV catalog. These metrics suggest a moderate risk that is primarily relevant to privileged users or systems with compromised local access, with exploitation likely limited to local users with sufficient rights.