The hisi_sas driver for version 3 SAS hardware lacked a proper cleanup routine. When a remote PHY link reset happens while the driver is being removed, the kernel attempts to access a device link that has already been released, generating an unrecovered warning. This warning can indicate impending instability; no evidence in the description suggests an immediate crash or loss of confidentiality, but it implies a potential for system disruption.

All Linux kernel releases that include the hisi_sas module for v3 hardware are affected. The flaw exists in every kernel version prior to the patch that introduces the slave_destroy cleanup interface.

The CVSS score of 8.4 marks it as high severity, yet the EPSS score of <1% indicates a very low likelihood of exploitation. It is not listed in the CISA KEV catalog. Exploitation would require an attacker to trigger a PHY link reset while the driver is being unloaded, an activity that generally demands privileged access or the ability to load/unload kernel modules. Therefore the practical risk is moderate, bounded by the need for high-level privileges.