Skip to content
Heist/ feed
High

slip: fix use-after-free in sl_sync()

Type: advisorySource: Official CVE List1 source record

In the Linux kernel, the following vulnerability has been resolved: slip: fix use-after-free in sl_sync() slip_devs[] stores bare net_device pointers and takes no reference on them. sl_sync() and sl_alloc() walk that table from slip_open() under rtnl_lock(), while an entry is dropped by sl_free_netdev(), which sl_setup() installs as dev->priv_destructor. priv_destructor is called from netdev_run_todo(), which deliberately runs with the RTNL semaphore released so that it can sleep while waiting for the device refcount to drop: /* Snapshot list, allow later requests */ list_replace_init(&net_todo_list, &list); __rtnl_unlock(); ... if (dev->priv_destructor) dev->priv_destructor(dev); /* slip_devs[i] = NULL */ if (dev->needs_free_netdev) free_netdev(dev); ... /* Free network device */ kobject_put(&dev->dev.kobj); So rtnl_lock() does not serialise slip_open() against the teardown at all. sl_sync() can load slip_devs[i] while the entry is still published and dereference it after netdev_run_todo() has run the destructor and released the device: CPU0 (slip_open) CPU1 (slip_close) unregister_netdev() rtnl_unlock() netdev_run_todo() __rtnl_unlock() rtnl_lock() sl_sync() dev = slip_devs[i] priv_destructor(dev) slip_devs[i] = NULL kobject_put(&dev->dev.kobj) /* dev is freed */ sl = netdev_priv(dev) if (sl->tty || sl->leased) /* use-after-free */ BUG: KASAN: use-after-free in sl_sync drivers/net/slip/slip.c:730 [inline] BUG: KASAN: use-after-free in slip_open+0xef4/0x1210 drivers/net/slip

Announced Source revision 1
Original source ↗

CVE-2026-81001

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-81001

Linux

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Linux

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "5342b77c4123ba39f911d92a813295fb3bb21f69",
        "lessThan": "045e307ac21fbd735b789d8817b21be4d8ead054",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "5342b77c4123ba39f911d92a813295fb3bb21f69",
        "lessThan": "87398cdec8bdf84096a8af4dbccdb04f1972f32c",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "5342b77c4123ba39f911d92a813295fb3bb21f69",
        "lessThan": "e93ace1f46177a4f7b5a8e5996606cdf77e1e890",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "5342b77c4123ba39f911d92a813295fb3bb21f69",
        "lessThan": "70e20456bcbf7f3ae145bb96e5548f827a37c640",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "5342b77c4123ba39f911d92a813295fb3bb21f69",
        "lessThan": "a235b20972bbd98ca1fb127d6269434edc607f19",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "5342b77c4123ba39f911d92a813295fb3bb21f69",
        "lessThan": "486577db807891d0f964fdf13c1640c7f54b0ad1",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "5342b77c4123ba39f911d92a813295fb3bb21f69",
        "lessThan": "d6f25e5bd777b05880da8673daf74a8419480545",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "5342b77c4123ba39f911d92a813295fb3bb21f69",
        "lessThan": "2c4e7c42d77e78ad595dbb9e4b5886b58b45d89d",
        "versionType": "git"
      }
    ],
    "programFiles": [
      "drivers/net/slip/slip.c"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "2.6.32"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "2.6.32",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "5.10.270",
        "versionType": "semver",
        "lessThanOrEqual": "5.10.*"
      },
      {
        "status": "unaffected",
        "version": "5.15.221",
        "versionType": "semver",
        "lessThanOrEqual": "5.15.*"
      },
      {
        "status": "unaffected",
        "version": "6.1.188",
        "versionType": "semver",
        "lessThanOrEqual": "6.1.*"
      },
      {
        "status": "unaffected",
        "version": "6.6.157",
        "versionType": "semver",
        "lessThanOrEqual": "6.6.*"
      },
      {
        "status": "unaffected",
        "version": "6.12.109",
        "versionType": "semver",
        "lessThanOrEqual": "6.12.*"
      },
      {
        "status": "unaffected",
        "version": "6.18.50",
        "versionType": "semver",
        "lessThanOrEqual": "6.18.*"
      },
      {
        "status": "unaffected",
        "version": "7.2.4",
        "versionType": "semver",
        "lessThanOrEqual": "7.2.*"
      },
      {
        "status": "unaffected",
        "version": "7.3",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "drivers/net/slip/slip.c"
    ],
    "defaultStatus": "affected"
  }
]
Related CVEs
CVE-2026-81001

Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event
#34955 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement