Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-81001— slip: fix use-after-free in sl_sync()

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会开源的一个操作系统内核。 Linux kernel存在安全漏洞，该漏洞源于slip驱动中slip_devs[]存储裸net_device指针且未获取引用，rtnl_lock()未能序列化slip_open()与设备销毁过程，导致sl_sync()访问已释放的net_device，造成释放后重用。

CVSS 7.8 · High EPSS 0.16% · P5

Possible ATT&CK Techniques 1 AI

T1015

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux 5342b77c4123ba39f911d92a813295fb3bb21f69< 045e307ac21fbd735b789d8817b21be4d8ead054 affected
5342b77c4123ba39f911d92a813295fb3bb21f69< 87398cdec8bdf84096a8af4dbccdb04f1972f32c affected
5342b77c4123ba39f911d92a813295fb3bb21f69< e93ace1f46177a4f7b5a8e5996606cdf77e1e890 affected
5342b77c4123ba39f911d92a813295fb3bb21f69< 70e20456bcbf7f3ae145bb96e5548f827a37c640 affected
5342b77c4123ba39f911d92a813295fb3bb21f69< a235b20972bbd98ca1fb127d6269434edc607f19 affected
5342b77c4123ba39f911d92a813295fb3bb21f69< 486577db807891d0f964fdf13c1640c7f54b0ad1 affected
5342b77c4123ba39f911d92a813295fb3bb21f69< d6f25e5bd777b05880da8673daf74a8419480545 affected
5342b77c4123ba39f911d92a813295fb3bb21f69< 2c4e7c42d77e78ad595dbb9e4b5886b58b45d89d affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-81001

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
slip: fix use-after-free in sl_sync()
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: slip: fix use-after-free in sl_sync() slip_devs[] stores bare net_device pointers and takes no reference on them. sl_sync() and sl_alloc() walk that table from slip_open() under rtnl_lock(), while an entry is dropped by sl_free_netdev(), which sl_setup() installs as dev->priv_destructor. priv_destructor is called from netdev_run_todo(), which deliberately runs with the RTNL semaphore released so that it can sleep while waiting for the device refcount to drop: /* Snapshot list, allow later requests */ list_replace_init(&net_todo_list, &list); __rtnl_unlock(); ... if (dev->priv_destructor) dev->priv_destructor(dev); /* slip_devs[i] = NULL */ if (dev->needs_free_netdev) free_netdev(dev); ... /* Free network device */ kobject_put(&dev->dev.kobj); So rtnl_lock() does not serialise slip_open() against the teardown at all. sl_sync() can load slip_devs[i] while the entry is still published and dereference it after netdev_run_todo() has run the destructor and released the device: CPU0 (slip_open) CPU1 (slip_close) unregister_netdev() rtnl_unlock() netdev_run_todo() __rtnl_unlock() rtnl_lock() sl_sync() dev = slip_devs[i] priv_destructor(dev) slip_devs[i] = NULL kobject_put(&dev->dev.kobj) /* dev is freed */ sl = netdev_priv(dev) if (sl->tty || sl->leased) /* use-after-free */ BUG: KASAN: use-after-free in sl_sync drivers/net/slip/slip.c:730 [inline] BUG: KASAN: use-after-free in slip_open+0xef4/0x1210 drivers/net/slip/slip.c:806 Read of size 1 at addr ffff8880712dac71 by task syz-executor.2/6506 CPU: 2 PID: 6506 Comm: syz-executor.2 Not tainted 6.1.134-syzkaller-00260-g0c8fc3469765 #0 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 Call Trace: sl_sync drivers/net/slip/slip.c:730 [inline] slip_open+0xef4/0x1210 drivers/net/slip/slip.c:806 tty_ldisc_open+0xa2/0x120 drivers/tty/tty_ldisc.c:433 tty_set_ldisc+0x324/0x720 drivers/tty/tty_ldisc.c:564 tiocsetd drivers/tty/tty_io.c:2428 [inline] tty_ioctl+0x5f0/0x1530 drivers/tty/tty_io.c:2712 Allocated by task 6502: alloc_netdev_mqs+0x98/0xfe0 net/core/dev.c:10719 sl_alloc drivers/net/slip/slip.c:756 [inline] slip_open+0x36d/0x1210 drivers/net/slip/slip.c:817 tty_ldisc_open+0xa2/0x120 drivers/tty/tty_ldisc.c:433 tty_set_ldisc+0x324/0x720 drivers/tty/tty_ldisc.c:564 Freed by task 6497: device_release+0xa2/0x240 drivers/base/core.c:2507 kobject_put+0x179/0x280 lib/kobject.c:729 netdev_run_todo+0x6c8/0xef0 net/core/dev.c:10509 slip_close+0x166/0x1c0 drivers/net/slip/slip.c:906 tty_ldisc_close+0x113/0x1a0 drivers/tty/tty_ldisc.c:456 tty_ldisc_kill+0x94/0x160 drivers/tty/tty_ldisc.c:614 tty_ldisc_release+0xe3/0x2b0 drivers/tty/tty_ldisc.c:782 tty_release+0xbcc/0xe70 drivers/tty/tty_io.c:1860 Commit e58c19124189 ("slip: Fix use-after-free Read in slip_open") fixed a different source of stale entries - a device left in slip_devs[] after slip_open() freed it on the registration error path - and does not address this race, which is why the report survives it. Drop the entry from ndo_uninit instead. unregister_netdevice() calls ndo_uninit under RTNL, before the device is queued to netdev_run_todo(), so an entry that sl_sync() can still see while holding RTNL belongs to a device that cannot be freed until RTNL is dropped. sl_free_netdev() stays only for the slip_open() error path, where register_netdevice() may have failed before ndo_init and ndo_uninit is then not called either. Both running for the same device is harmless: the ---truncated---
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会开源的一个操作系统内核。 Linux kernel存在安全漏洞，该漏洞源于slip驱动中slip_devs[]存储裸net_device指针且未获取引用，rtnl_lock()未能序列化slip_open()与设备销毁过程，导致sl_sync()访问已释放的net_device，造成释放后重用。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 5342b77c4123ba39f911d92a813295fb3bb21f69 ~ 045e307ac21fbd735b789d8817b21be4d8ead054 -
Linux Linux 2.6.32 -

II. Public POCs for CVE-2026-81001

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-81001

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-81001 (8)

Same Patch Batch · Linux · 2026-09-11 · 430 CVEs total

CVE-2026-89703 9.8 CRITICAL nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_stid for delegations
CVE-2026-89689 9.8 CRITICAL nfsd: don't free session slots that are still in use
CVE-2026-89558 9.8 CRITICAL md/raid10: fix still_degraded being inverted in raid10_sync_request()
CVE-2026-89555 9.8 CRITICAL mpls: reload header after pskb_may_pull()
CVE-2026-89550 9.8 CRITICAL SUNRPC: svcauth_gss: enforce krb5 token minimum length
CVE-2026-89551 9.8 CRITICAL SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow
CVE-2026-89546 9.8 CRITICAL SUNRPC: close backchannel before destroying callback service
CVE-2026-89542 9.8 CRITICAL SUNRPC: harden gss_krb5_unwrap_v2 against short tokens
CVE-2026-89541 9.8 CRITICAL SUNRPC: harden gss_unwrap_resp_priv length checks
CVE-2026-89538 9.8 CRITICAL SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field
CVE-2026-89536 9.8 CRITICAL SUNRPC: wait for in-flight client TLS handshake callback
CVE-2026-89533 9.8 CRITICAL svcrdma: Fix offset arithmetic in read_chunk_range
CVE-2026-89530 9.8 CRITICAL svcrdma: Reject inline replies that overflow the pull-up buffer
CVE-2026-89526 9.8 CRITICAL svcrdma: Validate Read chunk positions before reconstruction
CVE-2026-81002 9.8 CRITICAL xdp: fix zero-copy frame layout
CVE-2026-89482 9.8 CRITICAL nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone
CVE-2026-89478 9.8 CRITICAL sctp: drop a chunk if its transport was removed
CVE-2026-89479 9.8 CRITICAL sctp: stop processing a packet once its association is deleted
CVE-2026-89485 9.8 CRITICAL lockd: pin next file across nlm_inspect_file lock-drop
CVE-2026-80986 9.8 CRITICAL net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages

Showing top 20 of 430 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-81001

No comments yet

Leave a comment