Executive brief
The Linux kernel's SLIP (Serial Line Internet Protocol) driver contains a race condition that can lead to use-after-free memory access. An attacker with local access can trigger this vulnerability during device open/close operations, potentially causing a kernel crash or executing arbitrary code with kernel privileges.
Technical details
The vulnerability is a use-after-free in the SLIP driver's sl_sync() function caused by inadequate synchronization between device registration/unregistration and the network device destructor. The slip_devs[] array holds bare net_device pointers without reference counting. When sl_sync() is called under rtnl_lock() during slip_open(), a device entry can be dereferenced after its destructor (sl_free_netdev()) has already run and freed the device, which executes outside the RTNL lock in netdev_run_todo(). The vulnerability requires local access to invoke the affected code path through tty ioctl operations. The fix moves the slip_devs[] entry cleanup from the priv_destructor to ndo_uninit(), which is called under RTNL before the device is queued for teardown, ensuring proper synchronization.
Affected products
- Linux Linux kernel 6.1.134 and likely other versions
Timeline
- 2026-09-11: disclosed