{ "affected": [ { "ranges": [ { "events": [ { "introduced": "5342b77c4123ba39f911d92a813295fb3bb21f69" }, { "fixed": "045e307ac21fbd735b789d8817b21be4d8ead054" }, { "fixed": "87398cdec8bdf84096a8af4dbccdb04f1972f32c" }, { "fixed": "e93ace1f46177a4f7b5a8e5996606cdf77e1e890" }, { "fixed": "70e20456bcbf7f3ae145bb96e5548f827a37c640" }, { "fixed": "a235b20972bbd98ca1fb127d6269434edc607f19" }, { "fixed": "486577db807891d0f964fdf13c1640c7f54b0ad1" }, { "fixed": "d6f25e5bd777b05880da8673daf74a8419480545" }, { "fixed": "2c4e7c42d77e78ad595dbb9e4b5886b58b45d89d" } ], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "type": "GIT" } ] }, { "package": { "ecosystem": "Linux", "name": "Kernel" }, "ranges": [ { "events": [ { "introduced": "2.6.32" }, { "fixed": "5.10.270" } ], "type": "ECOSYSTEM" }, { "events": [ { "introduced": "5.11.0" }, { "fixed": "5.15.221" } ], "type": "ECOSYSTEM" }, { "events": [ { "introduced": "5.16.0" }, { "fixed": "6.1.188" } ], "type": "ECOSYSTEM" }, { "events": [ { "introduced": "6.2.0" }, { "fixed": "6.6.157" } ], "type": "ECOSYSTEM" }, { "events": [ { "introduced": "6.7.0" }, { "fixed": "6.12.109" } ], "type": "ECOSYSTEM" }, { "events": [ { "introduced": "6.13.0" }, { "fixed": "6.18.50" } ], "type": "ECOSYSTEM" }, { "events": [ { "introduced": "6.19.0" }, { "fixed": "7.2.4" } ], "type": "ECOSYSTEM" } ] } ], "database_specific": { "cna_assigner": "Linux", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81001.json" }, "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nslip: fix use-after-free in sl_sync()\n\nslip_devs[] stores bare net_device pointers and takes no reference on\nthem. sl_sync() and sl_alloc() walk that table from slip_open() under\nrtnl_lock(), while an entry is dropped by sl_free_netdev(), which\nsl_setup() installs as dev-\u003epriv_destructor.\n\npriv_destructor is called from netdev_run_todo(), which deliberately\nruns with the RTNL semaphore released so that it can sleep while waiting\nfor the device refcount to drop:\n\n\t/* Snapshot list, allow later requests */\n\tlist_replace_init(\u0026net_todo_list, \u0026list);\n\n\t__rtnl_unlock();\n\t...\n\t\tif (dev-\u003epriv_destructor)\n\t\t\tdev-\u003epriv_destructor(dev);\t/* slip_devs[i] = NULL */\n\t\tif (dev-\u003eneeds_free_netdev)\n\t\t\tfree_netdev(dev);\n\t\t...\n\t\t/* Free network device */\n\t\tkobject_put(\u0026dev-\u003edev.kobj);\n\nSo rtnl_lock() does not serialise slip_open() against the teardown at\nall. sl_sync() can load slip_devs[i] while the entry is still published\nand dereference it after netdev_run_todo() has run the destructor and\nreleased the device:\n\n CPU0 (slip_open) CPU1 (slip_close)\n unregister_netdev()\n rtnl_unlock()\n netdev_run_todo()\n __rtnl_unlock()\n rtnl_lock()\n sl_sync()\n dev = slip_devs[i]\n priv_destructor(dev)\n slip_devs[i] = NULL\n kobject_put(\u0026dev-\u003edev.kobj)\n /* dev is freed */\n sl = netdev_priv(dev)\n if (sl-\u003etty || sl-\u003eleased) /* use-after-free */\n\n BUG: KASAN: use-after-free in sl_sync drivers/net/slip/slip.c:730 [inline]\n BUG: KASAN: use-after-free in slip_open+0xef4/0x1210 drivers/net/slip/slip.c:806\n Read of size 1 at addr ffff8880712dac71 by task syz-executor.2/6506\n\n CPU: 2 PID: 6506 Comm: syz-executor.2 Not tainted 6.1.134-syzkaller-00260-g0c8fc3469765 #0\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014\n Call Trace:\n sl_sync drivers/net/slip/slip.c:730 [inline]\n slip_open+0xef4/0x1210 drivers/net/slip/slip.c:806\n tty_ldisc_open+0xa2/0x120 drivers/tty/tty_ldisc.c:433\n tty_set_ldisc+0x324/0x720 drivers/tty/tty_ldisc.c:564\n tiocsetd drivers/tty/tty_io.c:2428 [inline]\n tty_ioctl+0x5f0/0x1530 drivers/tty/tty_io.c:2712\n\n Allocated by task 6502:\n alloc_netdev_mqs+0x98/0xfe0 net/core/dev.c:10719\n sl_alloc drivers/net/slip/slip.c:756 [inline]\n slip_open+0x36d/0x1210 drivers/net/slip/slip.c:817\n tty_ldisc_open+0xa2/0x120 drivers/tty/tty_ldisc.c:433\n tty_set_ldisc+0x324/0x720 drivers/tty/tty_ldisc.c:564\n\n Freed by task 6497:\n device_release+0xa2/0x240 drivers/base/core.c:2507\n kobject_put+0x179/0x280 lib/kobject.c:729\n netdev_run_todo+0x6c8/0xef0 net/core/dev.c:10509\n slip_close+0x166/0x1c0 drivers/net/slip/slip.c:906\n tty_ldisc_close+0x113/0x1a0 drivers/tty/tty_ldisc.c:456\n tty_ldisc_kill+0x94/0x160 drivers/tty/tty_ldisc.c:614\n tty_ldisc_release+0xe3/0x2b0 drivers/tty/tty_ldisc.c:782\n tty_release+0xbcc/0xe70 drivers/tty/tty_io.c:1860\n\nCommit e58c19124189 (\"slip: Fix use-after-free Read in slip_open\") fixed\na different source of stale entries - a device left in slip_devs[] after\nslip_open() freed it on the registration error path - and does not\naddress this race, which is why the report survives it.\n\nDrop the entry from ndo_uninit instead. unregister_netdevice() calls\nndo_uninit under RTNL, before the device is queued to netdev_run_todo(),\nso an entry that sl_sync() can still see while holding RTNL belongs to a\ndevice that cannot be freed until RTNL is dropped. sl_free_netdev()\nstays only for the slip_open() error path, where register_netdevice()\nmay have failed before ndo_init and ndo_uninit is then not called\neither. Both running for the same device is harmless: the\n---truncated---", "id": "CVE-2026-81001", "modified": "2026-09-15T03:30:38.629252049Z", "published": "2026-09-11T19:42:54.846Z", "references": [ { "type": "WEB", "url": "https://git.kernel.org/stable/c/045e307ac21fbd735b789d8817b21be4d8ead054" }, { "type": "WEB", "url": "https://git.kernel.org/stable/c/2c4e7c42d77e78ad595dbb9e4b5886b58b45d89d" }, { "type": "WEB", "url": "https://git.kernel.org/stable/c/486577db807891d0f964fdf13c1640c7f54b0ad1" }, { "type": "WEB", "url": "https://git.kernel.org/stable/c/70e20456bcbf7f3ae145bb96e5548f827a37c640" }, { "type": "WEB", "url": "https://git.kernel.org/stable/c/87398cdec8bdf84096a8af4dbccdb04f1972f32c" }, { "type": "WEB", "url": "https://git.kernel.org/stable/c/a235b20972bbd98ca1fb127d6269434edc607f19" }, { "type": "WEB", "url": "https://git.kernel.org/stable/c/d6f25e5bd777b05880da8673daf74a8419480545" }, { "type": "WEB", "url": "https://git.kernel.org/stable/c/e93ace1f46177a4f7b5a8e5996606cdf77e1e890" }, { "type": "ADVISORY", "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81001.json" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-81001" }, { "type": "PACKAGE", "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git" } ], "schema_version": "1.9.0", "severity": [ { "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "type": "CVSS_V3" } ], "summary": "slip: fix use-after-free in sl_sync()" }