CVE-2026-90057

Status: UPDATED  |  Advisory ID: CVE-2026-90057

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

slip: remove slip_hangup() to fix use-after-free in slip_receive_buf()

Jaeyoung Chung and Eulgyu Kim reported a slab-use-after-free read

in slip_receive_buf() when racing against tty hangup.

tty_ldisc_hangup() calls ld->ops->hangup() while holding only

a read lock on tty->ldisc_sem (via tty_ldisc_ref()).

Because slip_hangup() simply called slip_close(), it ran concurrently

with reader functions such as slip_receive_buf().

slip_close() unregisters and frees the net device and its private

struct slip, causing concurrent reader threads in slip_receive_buf()

to dereference freed memory.

Line discipline close() is already guaranteed to be called under

the write lock of tty->ldisc_sem during hangup processing

(in tty_ldisc_reinit() or tty_ldisc_kill()).

Remove slip_hangup() so teardown is serialized cleanly by slip_close(). (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References