Action not permitted
Modal body text goes here.
Modal Title
Modal Body
EUVD-2026-367553
European Vulnerability Database identifier assigned by ENISAReserved
2026-10-02 08:36
Assigner
ENISA
Alias of
a CVE record, shown under related vulnerabilities.
This identifier carries no description, severity or references of its own:
they belong to that CVE.
{
"assigner": "ENISA",
"date_reserved": "2026-10-02T08:36:26.603662+00:00",
"id": "EUVD-2026-367553"
}
CVE-2026-81001 (GCVE-0-2026-81001)
Vulnerability from cvelistv5 – Published: 2026-09-11 19:42 – Updated: 2026-09-14 11:59
VLAI
EPSS
VEX
Title
slip: fix use-after-free in sl_sync()
Summary
In the Linux kernel, the following vulnerability has been resolved:
slip: fix use-after-free in sl_sync()
slip_devs[] stores bare net_device pointers and takes no reference on
them. sl_sync() and sl_alloc() walk that table from slip_open() under
rtnl_lock(), while an entry is dropped by sl_free_netdev(), which
sl_setup() installs as dev->priv_destructor.
priv_destructor is called from netdev_run_todo(), which deliberately
runs with the RTNL semaphore released so that it can sleep while waiting
for the device refcount to drop:
/* Snapshot list, allow later requests */
list_replace_init(&net_todo_list, &list);
__rtnl_unlock();
...
if (dev->priv_destructor)
dev->priv_destructor(dev); /* slip_devs[i] = NULL */
if (dev->needs_free_netdev)
free_netdev(dev);
...
/* Free network device */
kobject_put(&dev->dev.kobj);
So rtnl_lock() does not serialise slip_open() against the teardown at
all. sl_sync() can load slip_devs[i] while the entry is still published
and dereference it after netdev_run_todo() has run the destructor and
released the device:
CPU0 (slip_open) CPU1 (slip_close)
unregister_netdev()
rtnl_unlock()
netdev_run_todo()
__rtnl_unlock()
rtnl_lock()
sl_sync()
dev = slip_devs[i]
priv_destructor(dev)
slip_devs[i] = NULL
kobject_put(&dev->dev.kobj)
/* dev is freed */
sl = netdev_priv(dev)
if (sl->tty || sl->leased) /* use-after-free */
BUG: KASAN: use-after-free in sl_sync drivers/net/slip/slip.c:730 [inline]
BUG: KASAN: use-after-free in slip_open+0xef4/0x1210 drivers/net/slip/slip.c:806
Read of size 1 at addr ffff8880712dac71 by task syz-executor.2/6506
CPU: 2 PID: 6506 Comm: syz-executor.2 Not tainted 6.1.134-syzkaller-00260-g0c8fc3469765 #0
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
Call Trace:
sl_sync drivers/net/slip/slip.c:730 [inline]
slip_open+0xef4/0x1210 drivers/net/slip/slip.c:806
tty_ldisc_open+0xa2/0x120 drivers/tty/tty_ldisc.c:433
tty_set_ldisc+0x324/0x720 drivers/tty/tty_ldisc.c:564
tiocsetd drivers/tty/tty_io.c:2428 [inline]
tty_ioctl+0x5f0/0x1530 drivers/tty/tty_io.c:2712
Allocated by task 6502:
alloc_netdev_mqs+0x98/0xfe0 net/core/dev.c:10719
sl_alloc drivers/net/slip/slip.c:756 [inline]
slip_open+0x36d/0x1210 drivers/net/slip/slip.c:817
tty_ldisc_open+0xa2/0x120 drivers/tty/tty_ldisc.c:433
tty_set_ldisc+0x324/0x720 drivers/tty/tty_ldisc.c:564
Freed by task 6497:
device_release+0xa2/0x240 drivers/base/core.c:2507
kobject_put+0x179/0x280 lib/kobject.c:729
netdev_run_todo+0x6c8/0xef0 net/core/dev.c:10509
slip_close+0x166/0x1c0 drivers/net/slip/slip.c:906
tty_ldisc_close+0x113/0x1a0 drivers/tty/tty_ldisc.c:456
tty_ldisc_kill+0x94/0x160 drivers/tty/tty_ldisc.c:614
tty_ldisc_release+0xe3/0x2b0 drivers/tty/tty_ldisc.c:782
tty_release+0xbcc/0xe70 drivers/tty/tty_io.c:1860
Commit e58c19124189 ("slip: Fix use-after-free Read in slip_open") fixed
a different source of stale entries - a device left in slip_devs[] after
slip_open() freed it on the registration error path - and does not
address this race, which is why the report survives it.
Drop the entry from ndo_uninit instead. unregister_netdevice() calls
ndo_uninit under RTNL, before the device is queued to netdev_run_todo(),
so an entry that sl_sync() can still see while holding RTNL belongs to a
device that cannot be freed until RTNL is dropped. sl_free_netdev()
stays only for the slip_open() error path, where register_netdevice()
may have failed before ndo_init and ndo_uninit is then not called
either. Both running for the same device is harmless: the
---truncated---
Severity
7.8 (High)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
5342b77c4123ba39f911d92a813295fb3bb21f69 , < 045e307ac21fbd735b789d8817b21be4d8ead054
(git)
Affected: 5342b77c4123ba39f911d92a813295fb3bb21f69 , < 87398cdec8bdf84096a8af4dbccdb04f1972f32c (git) Affected: 5342b77c4123ba39f911d92a813295fb3bb21f69 , < e93ace1f46177a4f7b5a8e5996606cdf77e1e890 (git) Affected: 5342b77c4123ba39f911d92a813295fb3bb21f69 , < 70e20456bcbf7f3ae145bb96e5548f827a37c640 (git) Affected: 5342b77c4123ba39f911d92a813295fb3bb21f69 , < a235b20972bbd98ca1fb127d6269434edc607f19 (git) Affected: 5342b77c4123ba39f911d92a813295fb3bb21f69 , < 486577db807891d0f964fdf13c1640c7f54b0ad1 (git) Affected: 5342b77c4123ba39f911d92a813295fb3bb21f69 , < d6f25e5bd777b05880da8673daf74a8419480545 (git) Affected: 5342b77c4123ba39f911d92a813295fb3bb21f69 , < 2c4e7c42d77e78ad595dbb9e4b5886b58b45d89d (git) |
|
| Linux | Linux |
Affected:
2.6.32
Unaffected: 0 , < 2.6.32 (semver) Unaffected: 5.10.270 , ≤ 5.10.* (semver) Unaffected: 5.15.221 , ≤ 5.15.* (semver) Unaffected: 6.1.188 , ≤ 6.1.* (semver) Unaffected: 6.6.157 , ≤ 6.6.* (semver) Unaffected: 6.12.109 , ≤ 6.12.* (semver) Unaffected: 6.18.50 , ≤ 6.18.* (semver) Unaffected: 7.2.4 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/slip/slip.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "045e307ac21fbd735b789d8817b21be4d8ead054",
"status": "affected",
"version": "5342b77c4123ba39f911d92a813295fb3bb21f69",
"versionType": "git"
},
{
"lessThan": "87398cdec8bdf84096a8af4dbccdb04f1972f32c",
"status": "affected",
"version": "5342b77c4123ba39f911d92a813295fb3bb21f69",
"versionType": "git"
},
{
"lessThan": "e93ace1f46177a4f7b5a8e5996606cdf77e1e890",
"status": "affected",
"version": "5342b77c4123ba39f911d92a813295fb3bb21f69",
"versionType": "git"
},
{
"lessThan": "70e20456bcbf7f3ae145bb96e5548f827a37c640",
"status": "affected",
"version": "5342b77c4123ba39f911d92a813295fb3bb21f69",
"versionType": "git"
},
{
"lessThan": "a235b20972bbd98ca1fb127d6269434edc607f19",
"status": "affected",
"version": "5342b77c4123ba39f911d92a813295fb3bb21f69",
"versionType": "git"
},
{
"lessThan": "486577db807891d0f964fdf13c1640c7f54b0ad1",
"status": "affected",
"version": "5342b77c4123ba39f911d92a813295fb3bb21f69",
"versionType": "git"
},
{
"lessThan": "d6f25e5bd777b05880da8673daf74a8419480545",
"status": "affected",
"version": "5342b77c4123ba39f911d92a813295fb3bb21f69",
"versionType": "git"
},
{
"lessThan": "2c4e7c42d77e78ad595dbb9e4b5886b58b45d89d",
"status": "affected",
"version": "5342b77c4123ba39f911d92a813295fb3bb21f69",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/slip/slip.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.32"
},
{
"lessThan": "2.6.32",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.270",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.221",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.188",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.157",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.109",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.50",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.270",
"versionStartIncluding": "2.6.32",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.221",
"versionStartIncluding": "2.6.32",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.188",
"versionStartIncluding": "2.6.32",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.157",
"versionStartIncluding": "2.6.32",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.109",
"versionStartIncluding": "2.6.32",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.50",
"versionStartIncluding": "2.6.32",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.4",
"versionStartIncluding": "2.6.32",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3-rc1",
"versionStartIncluding": "2.6.32",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nslip: fix use-after-free in sl_sync()\n\nslip_devs[] stores bare net_device pointers and takes no reference on\nthem. sl_sync() and sl_alloc() walk that table from slip_open() under\nrtnl_lock(), while an entry is dropped by sl_free_netdev(), which\nsl_setup() installs as dev-\u003epriv_destructor.\n\npriv_destructor is called from netdev_run_todo(), which deliberately\nruns with the RTNL semaphore released so that it can sleep while waiting\nfor the device refcount to drop:\n\n\t/* Snapshot list, allow later requests */\n\tlist_replace_init(\u0026net_todo_list, \u0026list);\n\n\t__rtnl_unlock();\n\t...\n\t\tif (dev-\u003epriv_destructor)\n\t\t\tdev-\u003epriv_destructor(dev);\t/* slip_devs[i] = NULL */\n\t\tif (dev-\u003eneeds_free_netdev)\n\t\t\tfree_netdev(dev);\n\t\t...\n\t\t/* Free network device */\n\t\tkobject_put(\u0026dev-\u003edev.kobj);\n\nSo rtnl_lock() does not serialise slip_open() against the teardown at\nall. sl_sync() can load slip_devs[i] while the entry is still published\nand dereference it after netdev_run_todo() has run the destructor and\nreleased the device:\n\n CPU0 (slip_open) CPU1 (slip_close)\n unregister_netdev()\n rtnl_unlock()\n netdev_run_todo()\n __rtnl_unlock()\n rtnl_lock()\n sl_sync()\n dev = slip_devs[i]\n priv_destructor(dev)\n slip_devs[i] = NULL\n kobject_put(\u0026dev-\u003edev.kobj)\n /* dev is freed */\n sl = netdev_priv(dev)\n if (sl-\u003etty || sl-\u003eleased) /* use-after-free */\n\n BUG: KASAN: use-after-free in sl_sync drivers/net/slip/slip.c:730 [inline]\n BUG: KASAN: use-after-free in slip_open+0xef4/0x1210 drivers/net/slip/slip.c:806\n Read of size 1 at addr ffff8880712dac71 by task syz-executor.2/6506\n\n CPU: 2 PID: 6506 Comm: syz-executor.2 Not tainted 6.1.134-syzkaller-00260-g0c8fc3469765 #0\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014\n Call Trace:\n sl_sync drivers/net/slip/slip.c:730 [inline]\n slip_open+0xef4/0x1210 drivers/net/slip/slip.c:806\n tty_ldisc_open+0xa2/0x120 drivers/tty/tty_ldisc.c:433\n tty_set_ldisc+0x324/0x720 drivers/tty/tty_ldisc.c:564\n tiocsetd drivers/tty/tty_io.c:2428 [inline]\n tty_ioctl+0x5f0/0x1530 drivers/tty/tty_io.c:2712\n\n Allocated by task 6502:\n alloc_netdev_mqs+0x98/0xfe0 net/core/dev.c:10719\n sl_alloc drivers/net/slip/slip.c:756 [inline]\n slip_open+0x36d/0x1210 drivers/net/slip/slip.c:817\n tty_ldisc_open+0xa2/0x120 drivers/tty/tty_ldisc.c:433\n tty_set_ldisc+0x324/0x720 drivers/tty/tty_ldisc.c:564\n\n Freed by task 6497:\n device_release+0xa2/0x240 drivers/base/core.c:2507\n kobject_put+0x179/0x280 lib/kobject.c:729\n netdev_run_todo+0x6c8/0xef0 net/core/dev.c:10509\n slip_close+0x166/0x1c0 drivers/net/slip/slip.c:906\n tty_ldisc_close+0x113/0x1a0 drivers/tty/tty_ldisc.c:456\n tty_ldisc_kill+0x94/0x160 drivers/tty/tty_ldisc.c:614\n tty_ldisc_release+0xe3/0x2b0 drivers/tty/tty_ldisc.c:782\n tty_release+0xbcc/0xe70 drivers/tty/tty_io.c:1860\n\nCommit e58c19124189 (\"slip: Fix use-after-free Read in slip_open\") fixed\na different source of stale entries - a device left in slip_devs[] after\nslip_open() freed it on the registration error path - and does not\naddress this race, which is why the report survives it.\n\nDrop the entry from ndo_uninit instead. unregister_netdevice() calls\nndo_uninit under RTNL, before the device is queued to netdev_run_todo(),\nso an entry that sl_sync() can still see while holding RTNL belongs to a\ndevice that cannot be freed until RTNL is dropped. sl_free_netdev()\nstays only for the slip_open() error path, where register_netdevice()\nmay have failed before ndo_init and ndo_uninit is then not called\neither. Both running for the same device is harmless: the\n---truncated---"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The UAF is reached only via local TTY syscalls: open(\"/dev/ptmx\") then ioctl(TIOCSETD, N_SLIP) into tty_ioctl\u2192tiocsetd\u2192tty_set_ldisc\u2192slip_open\u2192sl_sync, raced with close()\u2192slip_close\u2192unregister_netdev. sl_sync() is not on the packet-receive path, so the vector is Local rather than Network or Physical.\nAC:L - The attacker controls both sides of the race, looping open(ptmx)+TIOCSETD(N_SLIP)+close() on several threads as in the syzkaller reproducer. netdev_run_todo() drops RTNL during attacker-initiated teardown, so winning the window does not depend on victim state or other uninfluenceable timing.\nPR:L - slip_open() requires capable(CAP_NET_ADMIN), which checks init_user_ns and is not granted by unshare -Urn. CAP_NET_ADMIN in the initial user namespace is still routinely delegated to non-root container and network workloads (Docker/K8s --cap-add=NET_ADMIN, CNI/VPN sidecars) without full host root, so privileges required are Low.\nUI:N - The attacker performs every step\u2014opening PTYs, attaching N_SLIP, and closing fds\u2014in its own processes. No separate victim user or administrator action is required at exploit time.\nS:U - The UAF corrupts a host-kernel net_device from alloc_netdev() and remains inside that kernel\u2019s security authority. Impact is standard local privilege escalation, not a VM escape or IOMMU/DMA boundary bypass.\nC:H - sl_sync() dereferences a freed net_device and its embedded struct slip (netdev_priv). Per kernel CNA guidance a use-after-free lets the attacker control the freed object via heap spray, yielding an arbitrary kernel read primitive.\nI:H - After the UAF load, sl_sync() may call dev_close() on the freed or reused net_device, exercising netdev_ops and related kernel state. That is a use-after-free of an object with function pointers, enabling arbitrary writes and control-flow hijacking.\nA:H - Use-after-free of the SLIP net_device causes a kernel oops or panic even when not fully exploited; KASAN reported a slab-use-after-free in sl_sync() on the syzkaller reproducer."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T11:59:36.376Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/045e307ac21fbd735b789d8817b21be4d8ead054"
},
{
"url": "https://git.kernel.org/stable/c/87398cdec8bdf84096a8af4dbccdb04f1972f32c"
},
{
"url": "https://git.kernel.org/stable/c/e93ace1f46177a4f7b5a8e5996606cdf77e1e890"
},
{
"url": "https://git.kernel.org/stable/c/70e20456bcbf7f3ae145bb96e5548f827a37c640"
},
{
"url": "https://git.kernel.org/stable/c/a235b20972bbd98ca1fb127d6269434edc607f19"
},
{
"url": "https://git.kernel.org/stable/c/486577db807891d0f964fdf13c1640c7f54b0ad1"
},
{
"url": "https://git.kernel.org/stable/c/d6f25e5bd777b05880da8673daf74a8419480545"
},
{
"url": "https://git.kernel.org/stable/c/2c4e7c42d77e78ad595dbb9e4b5886b58b45d89d"
}
],
"title": "slip: fix use-after-free in sl_sync()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-81001",
"datePublished": "2026-09-11T19:42:54.846Z",
"dateReserved": "2026-08-26T14:34:25.812Z",
"dateUpdated": "2026-09-14T11:59:36.376Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…
Loading…