Skip to content
Fencer Vulns
high 7.8

CVE-2026-81001 json

slip: fix use-after-free in sl_sync()

published 2026-09-11 58 d ago modified 2026-10-19 21 d ago also EUVD-2026-76324

cvss
7.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 5%
public exploits
0
none known

Summary

In the Linux kernel, the following vulnerability has been resolved:

slip: fix use-after-free in sl_sync()

slip_devs[] stores bare net_device pointers and takes no reference on them. sl_sync() and sl_alloc() walk that table from slip_open() under rtnl_lock(), while an entry is dropped by sl_free_netdev(), which sl_setup() installs as dev->priv_destructor.

priv_destructor is called from netdev_run_todo(), which deliberately runs with the RTNL semaphore released so that it can sleep while waiting for the device refcount to drop:

/* Snapshot list, allow later requests */ list_replace_init(&net_todo_list, &list);

__rtnl_unlock(); ... if (dev->priv_destructor) dev->priv_destructor(dev); /* slip_devs[i] = NULL */ if (dev->needs_free_netdev) free_netdev(dev); ... /* Free network device */ kobject_put(&dev->dev.kobj);

So rtnl_lock() does not serialise slip_open() against the teardown at all. sl_sync() can load slip_devs[i] while the entry is still published and dereference it after netdev_run_todo() has run the destructor and released the device:

CPU0 (slip_open) CPU1 (slip_close) unregister_netdev() rtnl_unlock() netdev_run_todo() __rtnl_unlock() rtnl_lock() sl_sync() dev = slip_devs[i] priv_destructor(dev) slip_devs[i] = NULL kobject_put(&dev->dev.kobj) /* dev is freed */ sl = netdev_priv(dev) if (sl->tty || sl->leased) /* use-after-free */

BUG: KASAN: use-after-free in sl_sync drivers/net/slip/slip.c:730 [inline] BUG: KASAN: use-after-free in slip_open+0xef4/0x1210 drivers/net/slip/slip.c:806 Read of size 1 at addr ffff8880712dac71 by task syz-executor.2/6506

CPU: 2 PID: 6506 Comm: syz-executor.2 Not tainted 6.1.134-syzkaller-00260-g0c8fc3469765 #0 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 Call Trace: sl_sync drivers/net/slip/slip.c:730 [inline] slip_open+0xef4/0x1210 drivers/net/slip/slip.c:806 tty_ldisc_open+0xa2/0x120 drivers/tty/tty_ldisc.c:433 tty_set_ldisc+0x324/0x720 drivers/tty/tty_ldisc.c:564 tiocsetd drivers/tty/tty_io.c:2428 [inline] tty_ioctl+0x5f0/0x1530 drivers/tty/tty_io.c:2712

Allocated by task 6502: alloc_netdev_mqs+0x98/0xfe0 net/core/dev.c:10719 sl_alloc drivers/net/slip/slip.c:756 [inline] slip_open+0x36d/0x1210 drivers/net/slip/slip.c:817 tty_ldisc_open+0xa2/0x120 drivers/tty/tty_ldisc.c:433 tty_set_ldisc+0x324/0x720 drivers/tty/tty_ldisc.c:564

Freed by task 6497: device_release+0xa2/0x240 drivers/base/core.c:2507 kobject_put+0x179/0x280 lib/kobject.c:729 netdev_run_todo+0x6c8/0xef0 net/core/dev.c:10509 slip_close+0x166/0x1c0 drivers/net/slip/slip.c:906 tty_ldisc_close+0x113/0x1a0 drivers/tty/tty_ldisc.c:456 tty_ldisc_kill+0x94/0x160 drivers/tty/tty_ldisc.c:614 tty_ldisc_release+0xe3/0x2b0 drivers/tty/tty_ldisc.c:782 tty_release+0xbcc/0xe70 drivers/tty/tty_io.c:1860

Commit e58c19124189 ("slip: Fix use-after-free Read in slip_open") fixed a different source of stale entries - a device left in slip_devs[] after slip_open() freed it on the registration error path - and does not address this race, which is why the report survives it.

Drop the entry from ndo_uninit instead. unregister_netdevice() calls ndo_uninit under RTNL, before the device is queued to netdev_run_todo(), so an entry that sl_sync() can still see while holding RTNL belongs to a device that cannot be freed until RTNL is dropped. sl_free_netdev() stays only for the slip_open() error path, where register_netdevice() may have failed before ndo_init and ndo_uninit is then not called either. Both running for the same device is harmless: the ---truncated---

Patch / fix

  • Linux Linux 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109, 6.18.50, 7.2.4, 7.3
  • linux Debian 12 6.1.190-1
  • linux Debian 13 6.12.111-1
  • linux Debian 14 7.2.6-1
  • linux-6.12 Debian 12 6.12.111-1~deb12u1

debian advisories DEBIAN-CVE-2026-81001

  • linux Ubuntu 22.04 LTS 5.15.0-202.212
  • linux Ubuntu 26.04 LTS 7.0.0-42.42
  • linux-aws Ubuntu 22.04 LTS 5.15.0-1119.126
  • linux-aws Ubuntu 26.04 LTS 7.0.0-1016.17
  • linux-gcp Ubuntu 22.04 LTS 5.15.0-1120.130
  • linux-gcp Ubuntu 26.04 LTS 7.0.0-1016.18
  • linux-gke Ubuntu 22.04 LTS 5.15.0-1115.121
  • linux-ibm Ubuntu 22.04 LTS 5.15.0-1113.117

ubuntu advisories UBUNTU-CVE-2026-81001

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • kernel-64kb SLE Module for Basesystem 15 SP7 6.4.0-150700.53.84.1
  • kernel-syms SLE Module for Development Tools 15 SP7 6.4.0-150700.53.84.1
  • kernel-azure SLE Module for Public Cloud 15 SP7 6.4.0-150700.53.84.1
  • kernel-source SLE Module for Development Tools 15 SP7, SLE Module for Basesystem 15 SP7 6.4.0-150700.53.84.1
  • kernel-default SLE Workstation Extension 15 SP7, SLE Module for Legacy 15 SP7, SLE Module for Basesystem 15 SP7 +2 more 6.4.0-150700.53.84.1
  • kernel-zfcpdump SLE Module for Basesystem 15 SP7 6.4.0-150700.53.84.1
  • kernel-obs-build SLE Module for Development Tools 15 SP7 6.4.0-150700.53.84.1
  • kernel-default-base SLE Module for Basesystem 15 SP7 6.4.0-150700.53.84.1.150700.17.47.1

suse advisories SUSE-SU-2026:4706-1SUSE-SU-2026:4687-1SUSE-SU-2026:4640-1SUSE-SU-2026:24316-1SUSE-SU-2026:24315-1SUSE-SU-2026:24181-1

  • kernel-rt openSUSE Leap 16.0 6.12.0-160000.39.1
  • dtb-aarch64 openSUSE Leap 16.0 6.12.0-160000.39.1
  • kernel-64kb openSUSE Leap 16.0 6.12.0-160000.39.1
  • kernel-syms openSUSE Leap 16.0 6.12.0-160000.39.1
  • kernel-azure openSUSE Leap 16.0 6.12.0-160000.39.1
  • kernel-obs-qa openSUSE Leap 16.0 6.12.0-160000.39.1
  • kernel-source openSUSE Leap 16.0 6.12.0-160000.39.1
  • kernel-default openSUSE Leap 16.0 6.12.0-160000.39.1

opensuse advisories openSUSE-SU-2026:22091-1openSUSE-SU-2026:11880-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-81001 updated cvss 4.7

kernel: slip: fix use-after-free in sl_sync()

  • Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-rt, kernel-core, kernel-tools, +29 more Red Hat Enterprise Linux 9 rv, perf, rtla, kernel, bpftool, libperf, +83 more Red Hat Enterprise Linux 10 kernel Red Hat OpenShift Container Platform 4 openshift/ose-rhel-coreos-8, openshift/ose-rhel-coreos-9 Red Hat OpenShift Container Platform 5 openshift/ose-rhel-coreos-9
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
23 d ago

Exploit prediction

0.16% chance of exploitation in the next 30 days, higher than 5% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

  • Linux Linux

Classification

Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.