CVE-2026-81001: Linux Kernel SLIP Use-After-Free Vulnerability

CVE-2026-81001 Overview

CVE-2026-81001 is a use-after-free vulnerability in the Linux kernel's Serial Line Internet Protocol (SLIP) driver. The flaw resides in the sl_sync() function within drivers/net/slip/slip.c. The slip_devs[] array stores bare net_device pointers without taking references on them, creating a race between slip_open() and slip_close(). An attacker with local access can trigger the race by manipulating tty line disciplines, causing the kernel to dereference a freed net_device structure.

Critical Impact
Local attackers can trigger memory corruption in the Linux kernel through concurrent SLIP tty operations, potentially leading to privilege escalation or denial of service.

Affected Products

Linux kernel versions containing the SLIP driver (drivers/net/slip/slip.c)
Linux kernel 6.1.134 confirmed vulnerable per KASAN report
Multiple stable kernel branches receiving backported fixes

Discovery Timeline

2026-09-11 - CVE-2026-81001 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-81001

Vulnerability Analysis

The vulnerability is a use-after-free [CWE-416] in the SLIP network driver caused by improper synchronization between device teardown and line discipline attachment. The slip_devs[] table stores raw net_device pointers without reference counting. Both sl_sync() and sl_alloc() walk this table from slip_open() under rtnl_lock(). However, entries are removed by sl_free_netdev(), which sl_setup() registers as the device's priv_destructor.

The priv_destructor callback runs from netdev_run_todo(), which deliberately releases the RTNL semaphore so it can sleep while waiting for the device refcount to drop. As a result, rtnl_lock() fails to serialize slip_open() against device teardown. A concurrent sl_sync() call can load a slip_devs[i] pointer and dereference it after the destructor has freed the underlying device.

KASAN reports confirm the read of freed memory at sl_sync drivers/net/slip/slip.c:730 when sl->tty or sl->leased are accessed on the freed structure.

Root Cause

The root cause is that netdev_run_todo() intentionally drops RTNL to allow sleeping during refcount drain. This breaks the assumption in the SLIP driver that RTNL serializes all access to slip_devs[]. The priv_destructor clears the array entry after RTNL has already been released, so a parallel slip_open() that acquires RTNL can observe a stale pointer to memory that is subsequently freed by kobject_put().

Attack Vector

Exploitation requires local access and the ability to issue TIOCSETD ioctls to set tty line disciplines. A syzkaller reproducer demonstrates the race: CPU0 executes slip_open() calling sl_sync() while CPU1 concurrently executes slip_close() which triggers unregister_netdev() and netdev_run_todo(). The race window opens when netdev_run_todo() releases RTNL, allowing CPU0 to load the pointer before the destructor NULLs the slot and kobject_put() frees the device. Successful exploitation can corrupt kernel memory and enable local privilege escalation.

The fix moves entry removal from priv_destructor to ndo_uninit, which unregister_netdevice() calls under RTNL before queueing the device to netdev_run_todo(). Refer to the upstream commit e93ace1 for the patch series.

Detection Methods for CVE-2026-81001

Indicators of Compromise

KASAN reports containing use-after-free in sl_sync or use-after-free in slip_open in kernel logs
Unexpected kernel oops or panics referencing drivers/net/slip/slip.c:730 or slip.c:806
Processes issuing TIOCSETD ioctls to set the N_SLIP line discipline on tty devices from unprivileged contexts

Detection Strategies

Enable KASAN on test and staging kernels to surface use-after-free conditions in the SLIP driver during fuzzing
Monitor auditd or eBPF probes for repeated ioctl calls setting tty line disciplines in short time windows, which suggests race exploitation attempts
Inspect kernel ring buffer output for BUG or WARNING traces originating from sl_sync or slip_open

Monitoring Recommendations

Log tty ioctl activity from non-root users and alert on abnormal rates of TIOCSETD calls
Track loaded kernel modules and alert when the slip module is loaded on systems that do not require it
Correlate kernel crash telemetry with the affected process to identify potential exploitation attempts

How to Mitigate CVE-2026-81001

Immediate Actions Required

Apply the upstream kernel patches referenced in the NVD entry to all vulnerable Linux systems
Blacklist the slip kernel module on hosts that do not require SLIP functionality
Restrict local user access on multi-tenant systems where kernel exploitation is a concern

Patch Information

The fix relocates slip_devs[] entry removal from priv_destructor to the ndo_uninit callback. Because unregister_netdevice() invokes ndo_uninit under RTNL before queueing the device for netdev_run_todo(), any entry visible to sl_sync() while holding RTNL now belongs to a device that cannot be freed until RTNL is released. The sl_free_netdev() path is retained only for the slip_open() error case where register_netdevice() fails before ndo_init runs. Patches are available across multiple stable branches including commit 045e307, commit 2c4e7c4, commit 486577d, commit 70e2045, commit 87398cd, commit a235b20, commit d6f25e5, and commit e93ace1.

Workarounds

Blacklist the slip module by adding blacklist slip to /etc/modprobe.d/blacklist-slip.conf and rebuilding initramfs
Use kernel lockdown or module signature enforcement to prevent unprivileged loading of the SLIP driver
Apply seccomp or LSM policies to prevent untrusted processes from issuing TIOCSETD ioctls

bash

# Blacklist the vulnerable SLIP module
echo "blacklist slip" | sudo tee /etc/modprobe.d/blacklist-slip.conf
echo "install slip /bin/true" | sudo tee -a /etc/modprobe.d/blacklist-slip.conf
sudo update-initramfs -u

# Verify the module is not loaded
lsmod | grep slip