CVE-2026-90057: slip: remove slip_hangup() to fix use-after-free in slip_receive_buf()
In the Linux kernel, the following vulnerability has been resolved:
slip: remove sliphangup() to fix use-after-free in slipreceivebuf()
Jaeyoung Chung and Eulgyu Kim reported a slab-use-after-free read in slipreceivebuf() when racing against tty hangup.
ttyldischangup() calls ld->ops->hangup() while holding only a read lock on tty->ldiscsem (via ttyldiscref()). Because sliphangup() simply called slipclose(), it ran concurrently with reader functions such as slipreceivebuf().
slipclose() unregisters and frees the net device and its private struct slip, causing concurrent reader threads in slipreceivebuf() to dereference freed memory.
Line discipline close() is already guaranteed to be called under the write lock of tty->ldiscsem during hangup processing (in ttyldiscreinit() or ttyldisckill()).
Remove sliphangup() so teardown is serialized cleanly by slipclose().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel SLIP line discipline are affected when SLIP receive processing can race with a TTY hangup. The vulnerable path involves concurrent execution of slip_receive_buf() and teardown of the SLIP network device.
What causes the unsafe concurrency?
During TTY hangup, tty_ldisc_hangup() invoked the line discipline hangup callback while holding only a read lock on tty->ldisc_sem. The SLIP hangup callback called slip_close(), which could free the SLIP device and private data while receive-buffer readers were still using it.
How does the resolved implementation prevent the race?
The fix removes slip_hangup() so that teardown occurs through line-discipline close handling. Close processing is guaranteed to run under the write lock of tty->ldisc_sem, serializing teardown against reader functions such as slip_receive_buf().