CVE-2026-90057 - Vulnerability Details

- slip: remove slip_hangup() to fix use-after-free in slip_receive_buf()

Description

In the Linux kernel, the following vulnerability has been resolved:

slip: remove slip_hangup() to fix use-after-free in slip_receive_buf()

Jaeyoung Chung and Eulgyu Kim reported a slab-use-after-free read
in slip_receive_buf() when racing against tty hangup.

tty_ldisc_hangup() calls ld->ops->hangup() while holding only
a read lock on tty->ldisc_sem (via tty_ldisc_ref()).
Because slip_hangup() simply called slip_close(), it ran concurrently
with reader functions such as slip_receive_buf().

slip_close() unregisters and frees the net device and its private
struct slip, causing concurrent reader threads in slip_receive_buf()
to dereference freed memory.

Line discipline close() is already guaranteed to be called under
the write lock of tty->ldisc_sem during hangup processing
(in tty_ldisc_reinit() or tty_ldisc_kill()).

Remove slip_hangup() so teardown is serialized cleanly by slip_close().

Published: 2026-09-17

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A slab use‑after‑free occurs in slip_receive_buf() when a tty hangs up concurrently; slip_hangup() calls slip_close() which unregisters and frees the net device. A reader in slip_receive_buf() can then dereference freed memory, potentially allowing an attacker to read arbitrary kernel memory or trigger a crash. The weakness is a use‑after‑free flaw that can impact confidentiality and system stability.

Affected Systems

The vulnerability affects the Linux kernel’s slip line‑discipline driver. No specific kernel versions are listed; any build that enables the slip protocol is potentially affected until the issue is patched.

Risk and Exploitability

The CVSS score of 7.8 indicates high severity. The EPSS score is below 1 %, suggesting low likelihood of exploitation as of the current data, and the flaw is not yet listed in CISA’s KEV catalog. Attackers would need to trigger the race condition by causing a tty hangup while the slip protocol is in use; this likely requires local privileges or the ability to control a tty device. Once triggered, the use‑after‑free could expose kernel memory or destabilize the system, but no community‑reported exploits are known at this time.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`5342b77c4123ba39f911d92a813295fb3bb21f69`	affected	< 9a3b1edff1ecb47d323f2506b3ffc22178acd1c6
`5342b77c4123ba39f911d92a813295fb3bb21f69`	affected	< a2dbac3fb03b4427ccf057debc83fc61ee102529
`5342b77c4123ba39f911d92a813295fb3bb21f69`	affected	< de1f978c0f6ab42b28192d74dc59af52fdc76135
`5342b77c4123ba39f911d92a813295fb3bb21f69`	affected	< ddbc5dc5a2e29b3934da09c1ba3c930fd8a40fd6
`5342b77c4123ba39f911d92a813295fb3bb21f69`	affected	< a540a49fcca59d1c92c3a6462e67ca21676a88df
`5342b77c4123ba39f911d92a813295fb3bb21f69`	affected	< 23c53269f2baaedf2d92784290cb9ef6db2a3bce

Linux

affected

Version	Status	Constraints
`2.6.32`	affected	—
`0`	unaffected	< 2.6.32
`6.1.188`	unaffected	≤ 6.1.*
`6.6.157`	unaffected	≤ 6.6.*
`6.12.110`	unaffected	≤ 6.12.*
`6.18.52`	unaffected	≤ 6.18.*
`7.2.6`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[5342b77c4123ba39f911d92a813295fb3bb21f69,9a3b1edff1ecb47d323f2506b3ffc22178acd1c6)`	affected	code_commit	—
`[5342b77c4123ba39f911d92a813295fb3bb21f69,a2dbac3fb03b4427ccf057debc83fc61ee102529)`	affected	code_commit	—
`[5342b77c4123ba39f911d92a813295fb3bb21f69,de1f978c0f6ab42b28192d74dc59af52fdc76135)`	affected	code_commit	—
`[5342b77c4123ba39f911d92a813295fb3bb21f69,ddbc5dc5a2e29b3934da09c1ba3c930fd8a40fd6)`	affected	code_commit	—
`[5342b77c4123ba39f911d92a813295fb3bb21f69,a540a49fcca59d1c92c3a6462e67ca21676a88df)`	affected	code_commit	—
`[5342b77c4123ba39f911d92a813295fb3bb21f69,23c53269f2baaedf2d92784290cb9ef6db2a3bce)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`2.6.32`	affected	semver	—
`[0,2.6.32)`	unaffected	semver	—
`[6.1.188,6.2.0)`	unaffected	semver	—
`[6.6.157,6.7.0)`	unaffected	semver	—
`[6.12.110,6.13.0)`	unaffected	semver	—
`[6.18.52,6.19.0)`	unaffected	semver	—
`[7.2.6,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the kernel to a version that incorporates the patch removing slip_hangup() (commit references in the advisories).
If the system cannot be patched immediately, disable the slip driver or module and remove any serial interfaces that rely on slip to prevent the race from occurring.
Verify that no legacy slip configuration files remain active and that the system does not load the slip module during boot.

Generated by OpenCVE AI on September 20, 2026 at 04:06 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00171.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/23c53269f2baaedf2d92784290cb9ef6db2a3bce
https://git.kernel.org/stable/c/9a3b1edff1ecb47d323f2506b3ffc22178acd1c6
https://git.kernel.org/stable/c/a2dbac3fb03b4427ccf057debc83fc61ee102529
https://git.kernel.org/stable/c/a540a49fcca59d1c92c3a6462e67ca21676a88df
https://git.kernel.org/stable/c/ddbc5dc5a2e29b3934da09c1ba3c930fd8a40fd6
https://git.kernel.org/stable/c/de1f978c0f6ab42b28192d74dc59af52fdc76135

History

Sun, 20 Sep 2026 04:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Fri, 18 Sep 2026 21:30:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Thu, 17 Sep 2026 16:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: slip: remove slip_hangup() to fix use-after-free in slip_receive_buf() Jaeyoung Chung and Eulgyu Kim reported a slab-use-after-free read in slip_receive_buf() when racing against tty hangup. tty_ldisc_hangup() calls ld->ops->hangup() while holding only a read lock on tty->ldisc_sem (via tty_ldisc_ref()). Because slip_hangup() simply called slip_close(), it ran concurrently with reader functions such as slip_receive_buf(). slip_close() unregisters and frees the net device and its private struct slip, causing concurrent reader threads in slip_receive_buf() to dereference freed memory. Line discipline close() is already guaranteed to be called under the write lock of tty->ldisc_sem during hangup processing (in tty_ldisc_reinit() or tty_ldisc_kill()). Remove slip_hangup() so teardown is serialized cleanly by slip_close().
Title		slip: remove slip_hangup() to fix use-after-free in slip_receive_buf()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/23c53269f2baaedf2d92784290cb9ef6db2a3bce https://git.kernel.org/stable/c/9a3b1edff1ecb47d323f2506b3ffc22178acd1c6 https://git.kernel.org/stable/c/a2dbac3fb03b4427ccf057debc83fc61ee102529 https://git.kernel.org/stable/c/a540a49fcca59d1c92c3a6462e67ca21676a88df https://git.kernel.org/stable/c/ddbc5dc5a2e29b3934da09c1ba3c930fd8a40fd6 https://git.kernel.org/stable/c/de1f978c0f6ab42b28192d74dc59af52fdc76135

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-17T16:05:41.670Z

Updated: 2026-09-18T17:52:47.908Z

Reserved: 2026-09-11T19:38:34.784Z

Link: CVE-2026-90057

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-17T17:16:54.310

Modified: 2026-09-18T18:17:40.053

Link: CVE-2026-90057

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-09-20T04:15:17Z

Weaknesses

CWE-416
Use After Free

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object