CVE-2026-81001 - Vulnerability Details

Description

In the Linux kernel, the following vulnerability has been resolved:

slip: fix use-after-free in sl_sync()

slip_devs[] stores bare net_device pointers and takes no reference on
them. sl_sync() and sl_alloc() walk that table from slip_open() under
rtnl_lock(), while an entry is dropped by sl_free_netdev(), which
sl_setup() installs as dev->priv_destructor.

priv_destructor is called from netdev_run_todo(), which deliberately
runs with the RTNL semaphore released so that it can sleep while waiting
for the device refcount to drop:

/* Snapshot list, allow later requests */
list_replace_init(&net_todo_list, &list);

__rtnl_unlock();
...
if (dev->priv_destructor)
dev->priv_destructor(dev); /* slip_devs[i] = NULL */
if (dev->needs_free_netdev)
free_netdev(dev);
...
/* Free network device */
kobject_put(&dev->dev.kobj);

So rtnl_lock() does not serialise slip_open() against the teardown at
all. sl_sync() can load slip_devs[i] while the entry is still published
and dereference it after netdev_run_todo() has run the destructor and
released the device:

CPU0 (slip_open) CPU1 (slip_close)
unregister_netdev()
rtnl_unlock()
netdev_run_todo()
__rtnl_unlock()
rtnl_lock()
sl_sync()
dev = slip_devs[i]
priv_destructor(dev)
slip_devs[i] = NULL
kobject_put(&dev->dev.kobj)
/* dev is freed */
sl = netdev_priv(dev)
if (sl->tty || sl->leased) /* use-after-free */

BUG: KASAN: use-after-free in sl_sync drivers/net/slip/slip.c:730 [inline]
BUG: KASAN: use-after-free in slip_open+0xef4/0x1210 drivers/net/slip/slip.c:806
Read of size 1 at addr ffff8880712dac71 by task syz-executor.2/6506

CPU: 2 PID: 6506 Comm: syz-executor.2 Not tainted 6.1.134-syzkaller-00260-g0c8fc3469765 #0
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
Call Trace:
sl_sync drivers/net/slip/slip.c:730 [inline]
slip_open+0xef4/0x1210 drivers/net/slip/slip.c:806
tty_ldisc_open+0xa2/0x120 drivers/tty/tty_ldisc.c:433
tty_set_ldisc+0x324/0x720 drivers/tty/tty_ldisc.c:564
tiocsetd drivers/tty/tty_io.c:2428 [inline]
tty_ioctl+0x5f0/0x1530 drivers/tty/tty_io.c:2712

Allocated by task 6502:
alloc_netdev_mqs+0x98/0xfe0 net/core/dev.c:10719
sl_alloc drivers/net/slip/slip.c:756 [inline]
slip_open+0x36d/0x1210 drivers/net/slip/slip.c:817
tty_ldisc_open+0xa2/0x120 drivers/tty/tty_ldisc.c:433
tty_set_ldisc+0x324/0x720 drivers/tty/tty_ldisc.c:564

Freed by task 6497:
device_release+0xa2/0x240 drivers/base/core.c:2507
kobject_put+0x179/0x280 lib/kobject.c:729
netdev_run_todo+0x6c8/0xef0 net/core/dev.c:10509
slip_close+0x166/0x1c0 drivers/net/slip/slip.c:906
tty_ldisc_close+0x113/0x1a0 drivers/tty/tty_ldisc.c:456
tty_ldisc_kill+0x94/0x160 drivers/tty/tty_ldisc.c:614
tty_ldisc_release+0xe3/0x2b0 drivers/tty/tty_ldisc.c:782
tty_release+0xbcc/0xe70 drivers/tty/tty_io.c:1860

Commit e58c19124189 ("slip: Fix use-after-free Read in slip_open") fixed
a different source of stale entries - a device left in slip_devs[] after
slip_open() freed it on the registration error path - and does not
address this race, which is why the report survives it.

Drop the entry from ndo_uninit instead. unregister_netdevice() calls
ndo_uninit under RTNL, before the device is queued to netdev_run_todo(),
so an entry that sl_sync() can still see while holding RTNL belongs to a
device that cannot be freed until RTNL is dropped. sl_free_netdev()
stays only for the slip_open() error path, where register_netdevice()
may have failed before ndo_init and ndo_uninit is then not called
either. Both running for the same device is harmless: the
---truncated---

Published: 2026-09-11

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A use‑after‑free race condition exists in the Linux kernel slip driver. During a regular sl_sync() operation the entry has already been freed by a concurrent slip_close() flow, causing an invalid memory access that triggers a kernel Oops and a system crash. The flaw does not provide direct code execution but results in a denial of service and loss of kernel integrity.

Affected Systems

All Linux kernel are vulnerable. Any kernel build that ships with the slip driver and has not yet integrated the fix for the race is susceptible. The affected code exists in the core network stack; therefore users of the to verify if the patch is applied.

Risk and Exploitability

The CVSS vector gives a score of 7.8, indicating high severity. The EPSS score of <1% and the vulnerability is not listed in the CISA KEV catalog. Exploiting the flaw requires the ability to trigger the race condition, which typically needs root or kernel‑module privileges. Consequently, while the potential impact is severe, the overall risk to a non‑privileged system is considered low.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`5342b77c4123ba39f911d92a813295fb3bb21f69`	affected	< 045e307ac21fbd735b789d8817b21be4d8ead054
`5342b77c4123ba39f911d92a813295fb3bb21f69`	affected	< 87398cdec8bdf84096a8af4dbccdb04f1972f32c
`5342b77c4123ba39f911d92a813295fb3bb21f69`	affected	< e93ace1f46177a4f7b5a8e5996606cdf77e1e890
`5342b77c4123ba39f911d92a813295fb3bb21f69`	affected	< 70e20456bcbf7f3ae145bb96e5548f827a37c640
`5342b77c4123ba39f911d92a813295fb3bb21f69`	affected	< a235b20972bbd98ca1fb127d6269434edc607f19
`5342b77c4123ba39f911d92a813295fb3bb21f69`	affected	< 486577db807891d0f964fdf13c1640c7f54b0ad1
`5342b77c4123ba39f911d92a813295fb3bb21f69`	affected	< d6f25e5bd777b05880da8673daf74a8419480545
`5342b77c4123ba39f911d92a813295fb3bb21f69`	affected	< 2c4e7c42d77e78ad595dbb9e4b5886b58b45d89d

Linux

affected

Version	Status	Constraints
`2.6.32`	affected	—
`0`	unaffected	< 2.6.32
`5.10.270`	unaffected	≤ 5.10.*
`5.15.221`	unaffected	≤ 5.15.*
`6.1.188`	unaffected	≤ 6.1.*
`6.6.157`	unaffected	≤ 6.6.*
`6.12.109`	unaffected	≤ 6.12.*
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[5342b77c4123ba39f911d92a813295fb3bb21f69,a235b20972bbd98ca1fb127d6269434edc607f19)`	affected	code_commit	—
`[5342b77c4123ba39f911d92a813295fb3bb21f69,486577db807891d0f964fdf13c1640c7f54b0ad1)`	affected	code_commit	—
`[5342b77c4123ba39f911d92a813295fb3bb21f69,d6f25e5bd777b05880da8673daf74a8419480545)`	affected	code_commit	—
`[5342b77c4123ba39f911d92a813295fb3bb21f69,2c4e7c42d77e78ad595dbb9e4b5886b58b45d89d)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`2.6.32`	affected	semver	—
`[0,2.6.32)`	unaffected	semver	—
`[6.12.109,7.0.0)`	unaffected	semver	—
`[6.18.50,7.0.0)`	unaffected	semver	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the kernel update that includes the slip use‑after‑free fix to prevent kernel crashes.
If the patch is not immediately available, unload or blacklist the slip driver (e.g., via modprobe -r slip or adding "blacklist slip" to /etc/modprobe.d/blacklist.conf).
Recompile the kernel without the slip driver or ensure it remains disabled in the configuration to eliminate the vulnerability completely.

Generated by OpenCVE AI on September 21, 2026 at 01:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00171.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/045e307ac21fbd735b789d8817b21be4d8ead054
https://git.kernel.org/stable/c/2c4e7c42d77e78ad595dbb9e4b5886b58b45d89d
https://git.kernel.org/stable/c/486577db807891d0f964fdf13c1640c7f54b0ad1
https://git.kernel.org/stable/c/70e20456bcbf7f3ae145bb96e5548f827a37c640
https://git.kernel.org/stable/c/87398cdec8bdf84096a8af4dbccdb04f1972f32c
https://git.kernel.org/stable/c/a235b20972bbd98ca1fb127d6269434edc607f19
https://git.kernel.org/stable/c/d6f25e5bd777b05880da8673daf74a8419480545
https://git.kernel.org/stable/c/e93ace1f46177a4f7b5a8e5996606cdf77e1e890
https://nvd.nist.gov/vuln/detail/CVE-2026-81001
https://www.cve.org/CVERecord?id=CVE-2026-81001

History

Mon, 14 Sep 2026 12:30:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/045e307ac21fbd735b789d8817b21be4d8ead054 https://git.kernel.org/stable/c/70e20456bcbf7f3ae145bb96e5548f827a37c640 https://git.kernel.org/stable/c/87398cdec8bdf84096a8af4dbccdb04f1972f32c https://git.kernel.org/stable/c/e93ace1f46177a4f7b5a8e5996606cdf77e1e890

Sun, 13 Sep 2026 06:45:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Sat, 12 Sep 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://nvd.nist.gov/vuln/detail/CVE-2026-81001 https://www.cve.org/CVERecord?id=CVE-2026-81001
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Important`

Fri, 11 Sep 2026 23:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: slip: fix use-after-free in sl_sync() slip_devs[] stores bare net_device pointers and takes no reference on them. sl_sync() and sl_alloc() walk that table from slip_open() under rtnl_lock(), while an entry is dropped by sl_free_netdev(), which sl_setup() installs as dev->priv_destructor. priv_destructor is called from netdev_run_todo(), which deliberately runs with the RTNL semaphore released so that it can sleep while waiting for the device refcount to drop: /* Snapshot list, allow later requests / list_replace_init(&net_todo_list, &list); __rtnl_unlock(); ... if (dev->priv_destructor) dev->priv_destructor(dev); / slip_devs[i] = NULL / if (dev->needs_free_netdev) free_netdev(dev); ... / Free network device / kobject_put(&dev->dev.kobj); So rtnl_lock() does not serialise slip_open() against the teardown at all. sl_sync() can load slip_devs[i] while the entry is still published and dereference it after netdev_run_todo() has run the destructor and released the device: CPU0 (slip_open) CPU1 (slip_close) unregister_netdev() rtnl_unlock() netdev_run_todo() __rtnl_unlock() rtnl_lock() sl_sync() dev = slip_devs[i] priv_destructor(dev) slip_devs[i] = NULL kobject_put(&dev->dev.kobj) / dev is freed / sl = netdev_priv(dev) if (sl->tty \|\| sl->leased) / use-after-free */ BUG: KASAN: use-after-free in sl_sync drivers/net/slip/slip.c:730 [inline] BUG: KASAN: use-after-free in slip_open+0xef4/0x1210 drivers/net/slip/slip.c:806 Read of size 1 at addr ffff8880712dac71 by task syz-executor.2/6506 CPU: 2 PID: 6506 Comm: syz-executor.2 Not tainted 6.1.134-syzkaller-00260-g0c8fc3469765 #0 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 Call Trace: sl_sync drivers/net/slip/slip.c:730 [inline] slip_open+0xef4/0x1210 drivers/net/slip/slip.c:806 tty_ldisc_open+0xa2/0x120 drivers/tty/tty_ldisc.c:433 tty_set_ldisc+0x324/0x720 drivers/tty/tty_ldisc.c:564 tiocsetd drivers/tty/tty_io.c:2428 [inline] tty_ioctl+0x5f0/0x1530 drivers/tty/tty_io.c:2712 Allocated by task 6502: alloc_netdev_mqs+0x98/0xfe0 net/core/dev.c:10719 sl_alloc drivers/net/slip/slip.c:756 [inline] slip_open+0x36d/0x1210 drivers/net/slip/slip.c:817 tty_ldisc_open+0xa2/0x120 drivers/tty/tty_ldisc.c:433 tty_set_ldisc+0x324/0x720 drivers/tty/tty_ldisc.c:564 Freed by task 6497: device_release+0xa2/0x240 drivers/base/core.c:2507 kobject_put+0x179/0x280 lib/kobject.c:729 netdev_run_todo+0x6c8/0xef0 net/core/dev.c:10509 slip_close+0x166/0x1c0 drivers/net/slip/slip.c:906 tty_ldisc_close+0x113/0x1a0 drivers/tty/tty_ldisc.c:456 tty_ldisc_kill+0x94/0x160 drivers/tty/tty_ldisc.c:614 tty_ldisc_release+0xe3/0x2b0 drivers/tty/tty_ldisc.c:782 tty_release+0xbcc/0xe70 drivers/tty/tty_io.c:1860 Commit e58c19124189 ("slip: Fix use-after-free Read in slip_open") fixed a different source of stale entries - a device left in slip_devs[] after slip_open() freed it on the registration error path - and does not address this race, which is why the report survives it. Drop the entry from ndo_uninit instead. unregister_netdevice() calls ndo_uninit under RTNL, before the device is queued to netdev_run_todo(), so an entry that sl_sync() can still see while holding RTNL belongs to a device that cannot be freed until RTNL is dropped. sl_free_netdev() stays only for the slip_open() error path, where register_netdevice() may have failed before ndo_init and ndo_uninit is then not called either. Both running for the same device is harmless: the ---truncated---
Title		slip: fix use-after-free in sl_sync()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/2c4e7c42d77e78ad595dbb9e4b5886b58b45d89d https://git.kernel.org/stable/c/486577db807891d0f964fdf13c1640c7f54b0ad1 https://git.kernel.org/stable/c/a235b20972bbd98ca1fb127d6269434edc607f19 https://git.kernel.org/stable/c/d6f25e5bd777b05880da8673daf74a8419480545

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-11T19:42:54.846Z

Updated: 2026-09-14T11:59:36.376Z

Reserved: 2026-08-26T14:34:25.812Z

Link: CVE-2026-81001

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-11T20:19:08.160

Modified: 2026-09-14T13:18:54.360

Link: CVE-2026-81001

Redhat

Severity : Important

Publid Date: 2026-09-11T19:42:54Z

Links: CVE-2026-81001 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-21T02:00:09Z

Weaknesses

CWE-825
Expired Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object