CVE-2026-81001

In the Linux kernel, the following vulnerability has been resolved:

slip: fix use-after-free in sl sync()

slip devs[] stores bare net device pointers and takes no reference on them. sl sync() and sl alloc() walk that table from slip open() under rtnl lock(), while an entry is dropped by sl free netdev(), which sl setup() installs as dev->priv destructor.

priv destructor is called from netdev run todo(), which deliberately runs with the RTNL semaphore released so that it can sleep while waiting for the device refcount to drop:

/* Snapshot list, allow later requests */
list replace init(&net todo list, &list);

 rtnl unlock();
...
	if (dev->priv destructor)
		dev->priv destructor(dev);	/* slip devs[i] = NULL */
	if (dev->needs free netdev)
		free netdev(dev);
	...
	/* Free network device */
	kobject put(&dev->dev.kobj);

So rtnl lock() does not serialise slip open() against the teardown at all. sl sync() can load slip devs[i] while the entry is still published and dereference it after netdev run todo() has run the destructor and released the device:

CPU0 (slip open) CPU1 (slip close) unregister netdev() rtnl unlock() netdev run todo() rtnl unlock() rtnl lock() sl sync() dev = slip devs[i] priv destructor(dev) slip devs[i] = NULL kobject put(&dev->dev.kobj) /* dev is freed / sl = netdev priv(dev) if (sl->tty || sl->leased) / use-after-free */

BUG: KASAN: use-after-free in sl sync drivers/net/slip/slip.c:730 [inline] BUG: KASAN: use-after-free in slip open+0xef4/0x1210 drivers/net/slip/slip.c:806 Read of size 1 at addr ffff8880712dac71 by task syz-executor.2/6506

CPU: 2 PID: 6506 Comm: syz-executor.2 Not tainted 6.1.134-syzkaller-00260-g0c8fc3469765 #0 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 Call Trace: sl sync drivers/net/slip/slip.c:730 [inline] slip open+0xef4/0x1210 drivers/net/slip/slip.c:806 tty ldisc open+0xa2/0x120 drivers/tty/tty ldisc.c:433 tty set ldisc+0x324/0x720 drivers/tty/tty ldisc.c:564 tiocsetd drivers/tty/tty io.c:2428 [inline] tty ioctl+0x5f0/0x1530 drivers/tty/tty io.c:2712

Allocated by task 6502: alloc netdev mqs+0x98/0xfe0 net/core/dev.c:10719 sl alloc drivers/net/slip/slip.c:756 [inline] slip open+0x36d/0x1210 drivers/net/slip/slip.c:817 tty ldisc open+0xa2/0x120 drivers/tty/tty ldisc.c:433 tty set ldisc+0x324/0x720 drivers/tty/tty ldisc.c:564

Freed by task 6497: device release+0xa2/0x240 drivers/base/core.c:2507 kobject put+0x179/0x280 lib/kobject.c:729 netdev run todo+0x6c8/0xef0 net/core/dev.c:10509 slip close+0x166/0x1c0 drivers/net/slip/slip.c:906 tty ldisc close+0x113/0x1a0 drivers/tty/tty ldisc.c:456 tty ldisc kill+0x94/0x160 drivers/tty/tty ldisc.c:614 tty ldisc release+0xe3/0x2b0 drivers/tty/tty ldisc.c:782 tty release+0xbcc/0xe70 drivers/tty/tty io.c:1860

Commit e58c19124189 ("slip: Fix use-after-free Read in slip open") fixed a different source of stale entries - a device left in slip devs[] after slip open() freed it on the registration error path - and does not address this race, which is why the report survives it.

Drop the entry from ndo uninit instead. unregister netdevice() calls ndo uninit under RTNL, before the device is queued to netdev run todo(), so an entry that sl sync() can still see while holding RTNL belongs to a device that cannot be freed until RTNL is dropped. sl free netdev() stays only for the slip open() error path, where register netdevice() may have failed before ndo init and ndo uninit is then not called either. Both running for the same device is harmless: the ---truncated---