Security readout for executives and security teams
Plain-English summary
CVE-2024-26873 is a Linux kernel availability bug in the HiSilicon SAS storage driver. Under a specific hardware error and device-offline sequence, kernel worker tasks can deadlock, leaving storage-controller recovery stuck. Business impact is mainly outage or degraded storage availability on systems using this driver.
Executive priority
Treat as a targeted infrastructure reliability risk, not a broad internet-facing emergency. Patch affected storage servers through normal-to-expedited kernel maintenance, prioritizing systems where storage-controller hangs would interrupt critical workloads.
Technical view
The hisi_sas driver can deadlock when a disabling PHY command causes device removal while a 2-bit ECC error triggers automatic dump. The abort path holds the hisi_hba semaphore, blocking dump and controller reset, creating circular dependencies across libsas and hisi_sas workqueues.
Likely exposure
Exposure appears limited to Linux systems using HiSilicon SAS hardware and the hisi_sas kernel driver in affected kernel builds. Generic Linux hosts without this controller path are unlikely to be affected based on the supplied sources.
Exploitation context
The sources describe a concurrency and recovery-path deadlock, not a remote code execution issue. CISA KEV is false in the bundle, and no cited source claims active exploitation. Triggering appears tied to specific storage-controller operations and ECC error timing.
Researcher notes
The record lacks CVSS, CWE, and detailed distribution package mapping. Analysis should focus on kernel version lineage, whether hisi_sas is present, and whether vendor kernels backported the stable commits without changing upstream version numbers.
Mitigation direction
- Update to a Linux kernel build containing the referenced stable fixes.
- Prioritize servers using HiSilicon SAS controllers or the hisi_sas driver.
- Check distribution advisories for backported kernel packages.
- Plan maintenance windows for storage-controller kernel updates.
- If patches are unavailable, monitor vendor guidance for operational workarounds.
Validation and detection
- Inventory kernels running versions identified as affected in the source bundle.
- Check whether the hisi_sas driver is loaded on production systems.
- Map affected hosts to HiSilicon SAS storage hardware exposure.
- Review kernel logs for hung tasks involving hisi_sas or libsas workqueues.
- Confirm installed kernels include the referenced stable commits or vendor backports.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-26873 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/a47f0b03149af538af4442ff0702eac430ace1cbCVE reference, Linux
- https://git.kernel.org/stable/c/e022dd3b875315a2d2001a512e98d1dc8c991f4aCVE reference, Linux
- https://git.kernel.org/stable/c/85c98073ffcfe9e46abfb9c66f3364467119d563CVE reference, Linux
- https://git.kernel.org/stable/c/3c4f53b2c341ec6428b98cb51a89a09b025d0953CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.