CVE-2026-81001 (GCVE-0-2026-81001)
Vulnerability from cvelistv5
Published
2026-09-11 19:42
Modified
2026-10-19 08:46
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: slip: fix use-after-free in sl_sync() slip_devs[] stores bare net_device pointers and takes no reference on them. sl_sync() and sl_alloc() walk that table from slip_open() under rtnl_lock(), while an entry is dropped by sl_free_netdev(), which sl_setup() installs as dev->priv_destructor. priv_destructor is called from netdev_run_todo(), which deliberately runs with the RTNL semaphore released so that it can sleep while waiting for the device refcount to drop: /* Snapshot list, allow later requests */ list_replace_init(&net_todo_list, &list); __rtnl_unlock(); ... if (dev->priv_destructor) dev->priv_destructor(dev); /* slip_devs[i] = NULL */ if (dev->needs_free_netdev) free_netdev(dev); ... /* Free network device */ kobject_put(&dev->dev.kobj); So rtnl_lock() does not serialise slip_open() against the teardown at all. sl_sync() can load slip_devs[i] while the entry is still published and dereference it after netdev_run_todo() has run the destructor and released the device: CPU0 (slip_open) CPU1 (slip_close) unregister_netdev() rtnl_unlock() netdev_run_todo() __rtnl_unlock() rtnl_lock() sl_sync() dev = slip_devs[i] priv_destructor(dev) slip_devs[i] = NULL kobject_put(&dev->dev.kobj) /* dev is freed */ sl = netdev_priv(dev) if (sl->tty || sl->leased) /* use-after-free */ BUG: KASAN: use-after-free in sl_sync drivers/net/slip/slip.c:730 [inline] BUG: KASAN: use-after-free in slip_open+0xef4/0x1210 drivers/net/slip/slip.c:806 Read of size 1 at addr ffff8880712dac71 by task syz-executor.2/6506 CPU: 2 PID: 6506 Comm: syz-executor.2 Not tainted 6.1.134-syzkaller-00260-g0c8fc3469765 #0 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 Call Trace: sl_sync drivers/net/slip/slip.c:730 [inline] slip_open+0xef4/0x1210 drivers/net/slip/slip.c:806 tty_ldisc_open+0xa2/0x120 drivers/tty/tty_ldisc.c:433 tty_set_ldisc+0x324/0x720 drivers/tty/tty_ldisc.c:564 tiocsetd drivers/tty/tty_io.c:2428 [inline] tty_ioctl+0x5f0/0x1530 drivers/tty/tty_io.c:2712 Allocated by task 6502: alloc_netdev_mqs+0x98/0xfe0 net/core/dev.c:10719 sl_alloc drivers/net/slip/slip.c:756 [inline] slip_open+0x36d/0x1210 drivers/net/slip/slip.c:817 tty_ldisc_open+0xa2/0x120 drivers/tty/tty_ldisc.c:433 tty_set_ldisc+0x324/0x720 drivers/tty/tty_ldisc.c:564 Freed by task 6497: device_release+0xa2/0x240 drivers/base/core.c:2507 kobject_put+0x179/0x280 lib/kobject.c:729 netdev_run_todo+0x6c8/0xef0 net/core/dev.c:10509 slip_close+0x166/0x1c0 drivers/net/slip/slip.c:906 tty_ldisc_close+0x113/0x1a0 drivers/tty/tty_ldisc.c:456 tty_ldisc_kill+0x94/0x160 drivers/tty/tty_ldisc.c:614 tty_ldisc_release+0xe3/0x2b0 drivers/tty/tty_ldisc.c:782 tty_release+0xbcc/0xe70 drivers/tty/tty_io.c:1860 Commit e58c19124189 ("slip: Fix use-after-free Read in slip_open") fixed a different source of stale entries - a device left in slip_devs[] after slip_open() freed it on the registration error path - and does not address this race, which is why the report survives it. Drop the entry from ndo_uninit instead. unregister_netdevice() calls ndo_uninit under RTNL, before the device is queued to netdev_run_todo(), so an entry that sl_sync() can still see while holding RTNL belongs to a device that cannot be freed until RTNL is dropped. sl_free_netdev() stays only for the slip_open() error path, where register_netdevice() may have failed before ndo_init and ndo_uninit is then not called either. Both running for the same device is harmless: the ---truncated---
References
Impacted products
Vendor Product Version
Linux Linux Version: 5342b77c4123ba39f911d92a813295fb3bb21f69
Version: 5342b77c4123ba39f911d92a813295fb3bb21f69
Version: 5342b77c4123ba39f911d92a813295fb3bb21f69
Version: 5342b77c4123ba39f911d92a813295fb3bb21f69
Version: 5342b77c4123ba39f911d92a813295fb3bb21f69
Version: 5342b77c4123ba39f911d92a813295fb3bb21f69
Version: 5342b77c4123ba39f911d92a813295fb3bb21f69
Version: 5342b77c4123ba39f911d92a813295fb3bb21f69
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-81001",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T19:22:06.585249Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T19:26:38.316Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/slip/slip.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "045e307ac21fbd735b789d8817b21be4d8ead054",
              "status": "affected",
              "version": "5342b77c4123ba39f911d92a813295fb3bb21f69",
              "versionType": "git"
            },
            {
              "lessThan": "87398cdec8bdf84096a8af4dbccdb04f1972f32c",
              "status": "affected",
              "version": "5342b77c4123ba39f911d92a813295fb3bb21f69",
              "versionType": "git"
            },
            {
              "lessThan": "e93ace1f46177a4f7b5a8e5996606cdf77e1e890",
              "status": "affected",
              "version": "5342b77c4123ba39f911d92a813295fb3bb21f69",
              "versionType": "git"
            },
            {
              "lessThan": "70e20456bcbf7f3ae145bb96e5548f827a37c640",
              "status": "affected",
              "version": "5342b77c4123ba39f911d92a813295fb3bb21f69",
              "versionType": "git"
            },
            {
              "lessThan": "a235b20972bbd98ca1fb127d6269434edc607f19",
              "status": "affected",
              "version": "5342b77c4123ba39f911d92a813295fb3bb21f69",
              "versionType": "git"
            },
            {
              "lessThan": "486577db807891d0f964fdf13c1640c7f54b0ad1",
              "status": "affected",
              "version": "5342b77c4123ba39f911d92a813295fb3bb21f69",
              "versionType": "git"
            },
            {
              "lessThan": "d6f25e5bd777b05880da8673daf74a8419480545",
              "status": "affected",
              "version": "5342b77c4123ba39f911d92a813295fb3bb21f69",
              "versionType": "git"
            },
            {
              "lessThan": "2c4e7c42d77e78ad595dbb9e4b5886b58b45d89d",
              "status": "affected",
              "version": "5342b77c4123ba39f911d92a813295fb3bb21f69",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/slip/slip.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.32"
            },
            {
              "lessThan": "2.6.32",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.270",
                  "versionStartIncluding": "2.6.32",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "2.6.32",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "2.6.32",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "2.6.32",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "2.6.32",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "2.6.32",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "2.6.32",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "2.6.32",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nslip: fix use-after-free in sl_sync()\n\nslip_devs[] stores bare net_device pointers and takes no reference on\nthem.  sl_sync() and sl_alloc() walk that table from slip_open() under\nrtnl_lock(), while an entry is dropped by sl_free_netdev(), which\nsl_setup() installs as dev-\u003epriv_destructor.\n\npriv_destructor is called from netdev_run_todo(), which deliberately\nruns with the RTNL semaphore released so that it can sleep while waiting\nfor the device refcount to drop:\n\n\t/* Snapshot list, allow later requests */\n\tlist_replace_init(\u0026net_todo_list, \u0026list);\n\n\t__rtnl_unlock();\n\t...\n\t\tif (dev-\u003epriv_destructor)\n\t\t\tdev-\u003epriv_destructor(dev);\t/* slip_devs[i] = NULL */\n\t\tif (dev-\u003eneeds_free_netdev)\n\t\t\tfree_netdev(dev);\n\t\t...\n\t\t/* Free network device */\n\t\tkobject_put(\u0026dev-\u003edev.kobj);\n\nSo rtnl_lock() does not serialise slip_open() against the teardown at\nall.  sl_sync() can load slip_devs[i] while the entry is still published\nand dereference it after netdev_run_todo() has run the destructor and\nreleased the device:\n\n  CPU0 (slip_open)                 CPU1 (slip_close)\n                                   unregister_netdev()\n                                     rtnl_unlock()\n                                       netdev_run_todo()\n                                         __rtnl_unlock()\n  rtnl_lock()\n  sl_sync()\n    dev = slip_devs[i]\n                                         priv_destructor(dev)\n                                           slip_devs[i] = NULL\n                                         kobject_put(\u0026dev-\u003edev.kobj)\n                                           /* dev is freed */\n    sl = netdev_priv(dev)\n    if (sl-\u003etty || sl-\u003eleased)     /* use-after-free */\n\n  BUG: KASAN: use-after-free in sl_sync drivers/net/slip/slip.c:730 [inline]\n  BUG: KASAN: use-after-free in slip_open+0xef4/0x1210 drivers/net/slip/slip.c:806\n  Read of size 1 at addr ffff8880712dac71 by task syz-executor.2/6506\n\n  CPU: 2 PID: 6506 Comm: syz-executor.2 Not tainted 6.1.134-syzkaller-00260-g0c8fc3469765 #0\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014\n  Call Trace:\n   sl_sync drivers/net/slip/slip.c:730 [inline]\n   slip_open+0xef4/0x1210 drivers/net/slip/slip.c:806\n   tty_ldisc_open+0xa2/0x120 drivers/tty/tty_ldisc.c:433\n   tty_set_ldisc+0x324/0x720 drivers/tty/tty_ldisc.c:564\n   tiocsetd drivers/tty/tty_io.c:2428 [inline]\n   tty_ioctl+0x5f0/0x1530 drivers/tty/tty_io.c:2712\n\n  Allocated by task 6502:\n   alloc_netdev_mqs+0x98/0xfe0 net/core/dev.c:10719\n   sl_alloc drivers/net/slip/slip.c:756 [inline]\n   slip_open+0x36d/0x1210 drivers/net/slip/slip.c:817\n   tty_ldisc_open+0xa2/0x120 drivers/tty/tty_ldisc.c:433\n   tty_set_ldisc+0x324/0x720 drivers/tty/tty_ldisc.c:564\n\n  Freed by task 6497:\n   device_release+0xa2/0x240 drivers/base/core.c:2507\n   kobject_put+0x179/0x280 lib/kobject.c:729\n   netdev_run_todo+0x6c8/0xef0 net/core/dev.c:10509\n   slip_close+0x166/0x1c0 drivers/net/slip/slip.c:906\n   tty_ldisc_close+0x113/0x1a0 drivers/tty/tty_ldisc.c:456\n   tty_ldisc_kill+0x94/0x160 drivers/tty/tty_ldisc.c:614\n   tty_ldisc_release+0xe3/0x2b0 drivers/tty/tty_ldisc.c:782\n   tty_release+0xbcc/0xe70 drivers/tty/tty_io.c:1860\n\nCommit e58c19124189 (\"slip: Fix use-after-free Read in slip_open\") fixed\na different source of stale entries - a device left in slip_devs[] after\nslip_open() freed it on the registration error path - and does not\naddress this race, which is why the report survives it.\n\nDrop the entry from ndo_uninit instead.  unregister_netdevice() calls\nndo_uninit under RTNL, before the device is queued to netdev_run_todo(),\nso an entry that sl_sync() can still see while holding RTNL belongs to a\ndevice that cannot be freed until RTNL is dropped.  sl_free_netdev()\nstays only for the slip_open() error path, where register_netdevice()\nmay have failed before ndo_init and ndo_uninit is then not called\neither.  Both running for the same device is harmless: the\n---truncated---"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The UAF is reached only via local TTY syscalls: open(\"/dev/ptmx\") then ioctl(TIOCSETD, N_SLIP) into tty_ioctl\u2192tiocsetd\u2192tty_set_ldisc\u2192slip_open\u2192sl_sync, raced with close()\u2192slip_close\u2192unregister_netdev. sl_sync() is not on the packet-receive path, so the vector is Local rather than Network or Physical.\nAC:L - The attacker controls both sides of the race, looping open(ptmx)+TIOCSETD(N_SLIP)+close() on several threads as in the syzkaller reproducer. netdev_run_todo() drops RTNL during attacker-initiated teardown, so winning the window does not depend on victim state or other uninfluenceable timing.\nPR:L - slip_open() requires capable(CAP_NET_ADMIN), which checks init_user_ns and is not granted by unshare -Urn. CAP_NET_ADMIN in the initial user namespace is still routinely delegated to non-root container and network workloads (Docker/K8s --cap-add=NET_ADMIN, CNI/VPN sidecars) without full host root, so privileges required are Low.\nUI:N - The attacker performs every step\u2014opening PTYs, attaching N_SLIP, and closing fds\u2014in its own processes. No separate victim user or administrator action is required at exploit time.\nS:U - The UAF corrupts a host-kernel net_device from alloc_netdev() and remains inside that kernel\u2019s security authority. Impact is standard local privilege escalation, not a VM escape or IOMMU/DMA boundary bypass.\nC:H - sl_sync() dereferences a freed net_device and its embedded struct slip (netdev_priv). Per kernel CNA guidance a use-after-free lets the attacker control the freed object via heap spray, yielding an arbitrary kernel read primitive.\nI:H - After the UAF load, sl_sync() may call dev_close() on the freed or reused net_device, exercising netdev_ops and related kernel state. That is a use-after-free of an object with function pointers, enabling arbitrary writes and control-flow hijacking.\nA:H - Use-after-free of the SLIP net_device causes a kernel oops or panic even when not fully exploited; KASAN reported a slab-use-after-free in sl_sync() on the syzkaller reproducer."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T08:46:25.639Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/045e307ac21fbd735b789d8817b21be4d8ead054"
        },
        {
          "url": "https://git.kernel.org/stable/c/87398cdec8bdf84096a8af4dbccdb04f1972f32c"
        },
        {
          "url": "https://git.kernel.org/stable/c/e93ace1f46177a4f7b5a8e5996606cdf77e1e890"
        },
        {
          "url": "https://git.kernel.org/stable/c/70e20456bcbf7f3ae145bb96e5548f827a37c640"
        },
        {
          "url": "https://git.kernel.org/stable/c/a235b20972bbd98ca1fb127d6269434edc607f19"
        },
        {
          "url": "https://git.kernel.org/stable/c/486577db807891d0f964fdf13c1640c7f54b0ad1"
        },
        {
          "url": "https://git.kernel.org/stable/c/d6f25e5bd777b05880da8673daf74a8419480545"
        },
        {
          "url": "https://git.kernel.org/stable/c/2c4e7c42d77e78ad595dbb9e4b5886b58b45d89d"
        }
      ],
      "title": "slip: fix use-after-free in sl_sync()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-81001",
    "datePublished": "2026-09-11T19:42:54.846Z",
    "dateReserved": "2026-08-26T14:34:25.812Z",
    "dateUpdated": "2026-10-19T08:46:25.639Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-81001\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-10-16T19:22:06.585249Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-10-16T19:22:07.179Z\"}}], \"cna\": {\"title\": \"slip: fix use-after-free in sl_sync()\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The UAF is reached only via local TTY syscalls: open(\\\"/dev/ptmx\\\") then ioctl(TIOCSETD, N_SLIP) into tty_ioctl\\u2192tiocsetd\\u2192tty_set_ldisc\\u2192slip_open\\u2192sl_sync, raced with close()\\u2192slip_close\\u2192unregister_netdev. sl_sync() is not on the packet-receive path, so the vector is Local rather than Network or Physical.\\nAC:L - The attacker controls both sides of the race, looping open(ptmx)+TIOCSETD(N_SLIP)+close() on several threads as in the syzkaller reproducer. netdev_run_todo() drops RTNL during attacker-initiated teardown, so winning the window does not depend on victim state or other uninfluenceable timing.\\nPR:L - slip_open() requires capable(CAP_NET_ADMIN), which checks init_user_ns and is not granted by unshare -Urn. CAP_NET_ADMIN in the initial user namespace is still routinely delegated to non-root container and network workloads (Docker/K8s --cap-add=NET_ADMIN, CNI/VPN sidecars) without full host root, so privileges required are Low.\\nUI:N - The attacker performs every step\\u2014opening PTYs, attaching N_SLIP, and closing fds\\u2014in its own processes. No separate victim user or administrator action is required at exploit time.\\nS:U - The UAF corrupts a host-kernel net_device from alloc_netdev() and remains inside that kernel\\u2019s security authority. Impact is standard local privilege escalation, not a VM escape or IOMMU/DMA boundary bypass.\\nC:H - sl_sync() dereferences a freed net_device and its embedded struct slip (netdev_priv). Per kernel CNA guidance a use-after-free lets the attacker control the freed object via heap spray, yielding an arbitrary kernel read primitive.\\nI:H - After the UAF load, sl_sync() may call dev_close() on the freed or reused net_device, exercising netdev_ops and related kernel state. That is a use-after-free of an object with function pointers, enabling arbitrary writes and control-flow hijacking.\\nA:H - Use-after-free of the SLIP net_device causes a kernel oops or panic even when not fully exploited; KASAN reported a slab-use-after-free in sl_sync() on the syzkaller reproducer.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5342b77c4123ba39f911d92a813295fb3bb21f69\", \"lessThan\": \"045e307ac21fbd735b789d8817b21be4d8ead054\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5342b77c4123ba39f911d92a813295fb3bb21f69\", \"lessThan\": \"87398cdec8bdf84096a8af4dbccdb04f1972f32c\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5342b77c4123ba39f911d92a813295fb3bb21f69\", \"lessThan\": \"e93ace1f46177a4f7b5a8e5996606cdf77e1e890\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5342b77c4123ba39f911d92a813295fb3bb21f69\", \"lessThan\": \"70e20456bcbf7f3ae145bb96e5548f827a37c640\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5342b77c4123ba39f911d92a813295fb3bb21f69\", \"lessThan\": \"a235b20972bbd98ca1fb127d6269434edc607f19\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5342b77c4123ba39f911d92a813295fb3bb21f69\", \"lessThan\": \"486577db807891d0f964fdf13c1640c7f54b0ad1\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5342b77c4123ba39f911d92a813295fb3bb21f69\", \"lessThan\": \"d6f25e5bd777b05880da8673daf74a8419480545\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5342b77c4123ba39f911d92a813295fb3bb21f69\", \"lessThan\": \"2c4e7c42d77e78ad595dbb9e4b5886b58b45d89d\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/net/slip/slip.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"2.6.32\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"2.6.32\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.10.270\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.221\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.188\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.157\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12.109\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.18.50\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.18.*\"}, {\"status\": \"unaffected\", \"version\": \"7.2.4\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.2.*\"}, {\"status\": \"unaffected\", \"version\": \"7.3\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/net/slip/slip.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/045e307ac21fbd735b789d8817b21be4d8ead054\"}, {\"url\": \"https://git.kernel.org/stable/c/87398cdec8bdf84096a8af4dbccdb04f1972f32c\"}, {\"url\": \"https://git.kernel.org/stable/c/e93ace1f46177a4f7b5a8e5996606cdf77e1e890\"}, {\"url\": \"https://git.kernel.org/stable/c/70e20456bcbf7f3ae145bb96e5548f827a37c640\"}, {\"url\": \"https://git.kernel.org/stable/c/a235b20972bbd98ca1fb127d6269434edc607f19\"}, {\"url\": \"https://git.kernel.org/stable/c/486577db807891d0f964fdf13c1640c7f54b0ad1\"}, {\"url\": \"https://git.kernel.org/stable/c/d6f25e5bd777b05880da8673daf74a8419480545\"}, {\"url\": \"https://git.kernel.org/stable/c/2c4e7c42d77e78ad595dbb9e4b5886b58b45d89d\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nslip: fix use-after-free in sl_sync()\\n\\nslip_devs[] stores bare net_device pointers and takes no reference on\\nthem.  sl_sync() and sl_alloc() walk that table from slip_open() under\\nrtnl_lock(), while an entry is dropped by sl_free_netdev(), which\\nsl_setup() installs as dev-\u003epriv_destructor.\\n\\npriv_destructor is called from netdev_run_todo(), which deliberately\\nruns with the RTNL semaphore released so that it can sleep while waiting\\nfor the device refcount to drop:\\n\\n\\t/* Snapshot list, allow later requests */\\n\\tlist_replace_init(\u0026net_todo_list, \u0026list);\\n\\n\\t__rtnl_unlock();\\n\\t...\\n\\t\\tif (dev-\u003epriv_destructor)\\n\\t\\t\\tdev-\u003epriv_destructor(dev);\\t/* slip_devs[i] = NULL */\\n\\t\\tif (dev-\u003eneeds_free_netdev)\\n\\t\\t\\tfree_netdev(dev);\\n\\t\\t...\\n\\t\\t/* Free network device */\\n\\t\\tkobject_put(\u0026dev-\u003edev.kobj);\\n\\nSo rtnl_lock() does not serialise slip_open() against the teardown at\\nall.  sl_sync() can load slip_devs[i] while the entry is still published\\nand dereference it after netdev_run_todo() has run the destructor and\\nreleased the device:\\n\\n  CPU0 (slip_open)                 CPU1 (slip_close)\\n                                   unregister_netdev()\\n                                     rtnl_unlock()\\n                                       netdev_run_todo()\\n                                         __rtnl_unlock()\\n  rtnl_lock()\\n  sl_sync()\\n    dev = slip_devs[i]\\n                                         priv_destructor(dev)\\n                                           slip_devs[i] = NULL\\n                                         kobject_put(\u0026dev-\u003edev.kobj)\\n                                           /* dev is freed */\\n    sl = netdev_priv(dev)\\n    if (sl-\u003etty || sl-\u003eleased)     /* use-after-free */\\n\\n  BUG: KASAN: use-after-free in sl_sync drivers/net/slip/slip.c:730 [inline]\\n  BUG: KASAN: use-after-free in slip_open+0xef4/0x1210 drivers/net/slip/slip.c:806\\n  Read of size 1 at addr ffff8880712dac71 by task syz-executor.2/6506\\n\\n  CPU: 2 PID: 6506 Comm: syz-executor.2 Not tainted 6.1.134-syzkaller-00260-g0c8fc3469765 #0\\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014\\n  Call Trace:\\n   sl_sync drivers/net/slip/slip.c:730 [inline]\\n   slip_open+0xef4/0x1210 drivers/net/slip/slip.c:806\\n   tty_ldisc_open+0xa2/0x120 drivers/tty/tty_ldisc.c:433\\n   tty_set_ldisc+0x324/0x720 drivers/tty/tty_ldisc.c:564\\n   tiocsetd drivers/tty/tty_io.c:2428 [inline]\\n   tty_ioctl+0x5f0/0x1530 drivers/tty/tty_io.c:2712\\n\\n  Allocated by task 6502:\\n   alloc_netdev_mqs+0x98/0xfe0 net/core/dev.c:10719\\n   sl_alloc drivers/net/slip/slip.c:756 [inline]\\n   slip_open+0x36d/0x1210 drivers/net/slip/slip.c:817\\n   tty_ldisc_open+0xa2/0x120 drivers/tty/tty_ldisc.c:433\\n   tty_set_ldisc+0x324/0x720 drivers/tty/tty_ldisc.c:564\\n\\n  Freed by task 6497:\\n   device_release+0xa2/0x240 drivers/base/core.c:2507\\n   kobject_put+0x179/0x280 lib/kobject.c:729\\n   netdev_run_todo+0x6c8/0xef0 net/core/dev.c:10509\\n   slip_close+0x166/0x1c0 drivers/net/slip/slip.c:906\\n   tty_ldisc_close+0x113/0x1a0 drivers/tty/tty_ldisc.c:456\\n   tty_ldisc_kill+0x94/0x160 drivers/tty/tty_ldisc.c:614\\n   tty_ldisc_release+0xe3/0x2b0 drivers/tty/tty_ldisc.c:782\\n   tty_release+0xbcc/0xe70 drivers/tty/tty_io.c:1860\\n\\nCommit e58c19124189 (\\\"slip: Fix use-after-free Read in slip_open\\\") fixed\\na different source of stale entries - a device left in slip_devs[] after\\nslip_open() freed it on the registration error path - and does not\\naddress this race, which is why the report survives it.\\n\\nDrop the entry from ndo_uninit instead.  unregister_netdevice() calls\\nndo_uninit under RTNL, before the device is queued to netdev_run_todo(),\\nso an entry that sl_sync() can still see while holding RTNL belongs to a\\ndevice that cannot be freed until RTNL is dropped.  sl_free_netdev()\\nstays only for the slip_open() error path, where register_netdevice()\\nmay have failed before ndo_init and ndo_uninit is then not called\\neither.  Both running for the same device is harmless: the\\n---truncated---\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.270\", \"versionStartIncluding\": \"2.6.32\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.221\", \"versionStartIncluding\": \"2.6.32\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.188\", \"versionStartIncluding\": \"2.6.32\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.157\", \"versionStartIncluding\": \"2.6.32\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.109\", \"versionStartIncluding\": \"2.6.32\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.18.50\", \"versionStartIncluding\": \"2.6.32\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"7.2.4\", \"versionStartIncluding\": \"2.6.32\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"7.3\", \"versionStartIncluding\": \"2.6.32\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-10-19T08:46:25.639Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-81001\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-10-19T08:46:25.639Z\", \"dateReserved\": \"2026-08-26T14:34:25.812Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2026-09-11T19:42:54.846Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.