CVE-2026-81001

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

slip: fix use-after-free in sl_sync()

slip_devs[] stores bare net_device pointers and takes no reference on

them. sl_sync() and sl_alloc() walk that table from slip_open() under

rtnl_lock(), while an entry is dropped by sl_free_netdev(), which

sl_setup() installs as dev->priv_destructor.

priv_destructor is called from netdev_run_todo(), which deliberately

runs with the RTNL semaphore released so that it can sleep while waiting

for the device refcount to drop:

/* Snapshot list, allow later requests */

list_replace_init(&net_todo_list, &list);

__rtnl_unlock();

...

if (dev->priv_destructor)

dev->priv_destructor(dev); /* slip_devs[i] = NULL */

if (dev->needs_free_netdev)

free_netdev(dev);

...

/* Free network device */

kobject_put(&dev->dev.kobj);

So rtnl_lock() does not serialise slip_open() against the teardown at

all. sl_sync() can load slip_devs[i] while the entry is still published

and deref

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References