The flaw lies in the Linux kernel’s hisi_sas driver where a missing cleanup interface for version 3 hardware causes a warning and kernel OOPS when a remote PHY link reset is performed at the same time as the driver is unloaded. The faulty logic accesses a device link that has already been removed, resulting in a kernel crash that interrupts system availability. The attack does not provide a path to compromise confidentiality or integrity.

Systems running any Linux kernel that includes the hisi_sas driver for v3 hardware are affected. The issue exists in any kernel revision that has not yet incorporated the introduced slave_destroy cleanup interface, regardless of specific patch level.

No CVSS or EPSS score is attached to this vulnerability, but the outcome is a denial‑of‑service. Exploitation requires the attacker to trigger a PHY link reset while the driver is being unloaded, a scenario that usually demands privileged access or an ability to run kernel modules. The vulnerability is not listed in the CISA KEV catalog.