{"id":"CVE-2026-90057","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nslip: remove slip_hangup() to fix use-after-free in slip_receive_buf()\n\nJaeyoung Chung and Eulgyu Kim reported a slab-use-after-free read\nin slip_receive_buf() when rac…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nslip: remove slip_hangup() to fix use-after-free in slip_receive_buf()\n\nJaeyoung Chung and Eulgyu Kim reported a slab-use-after-free read\nin slip_receive_buf() when rac…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","vendor":"Linux","product":"Linux","affected":["Linux >= 5342b77c4123ba39f911d92a813295fb3bb21f69 < 9a3b1edff1ecb47d323f2506b3ffc22178acd1c6","Linux >= 5342b77c4123ba39f911d92a813295fb3bb21f69 < a2dbac3fb03b4427ccf057debc83fc61ee102529","Linux >= 5342b77c4123ba39f911d92a813295fb3bb21f69 < de1f978c0f6ab42b28192d74dc59af52fdc76135","Linux >= 5342b77c4123ba39f911d92a813295fb3bb21f69 < ddbc5dc5a2e29b3934da09c1ba3c930fd8a40fd6","Linux >= 5342b77c4123ba39f911d92a813295fb3bb21f69 < a540a49fcca59d1c92c3a6462e67ca21676a88df","Linux >= 5342b77c4123ba39f911d92a813295fb3bb21f69 < 23c53269f2baaedf2d92784290cb9ef6db2a3bce","Linux 2.6.32"],"published":"2026-09-17","updated":"2026-09-18","sourceUpdated":"2026-09-18T18:17:40.053","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-90057","references":[{"url":"https://git.kernel.org/stable/c/23c53269f2baaedf2d92784290cb9ef6db2a3bce","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9a3b1edff1ecb47d323f2506b3ffc22178acd1c6","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a2dbac3fb03b4427ccf057debc83fc61ee102529","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a540a49fcca59d1c92c3a6462e67ca21676a88df","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ddbc5dc5a2e29b3934da09c1ba3c930fd8a40fd6","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/de1f978c0f6ab42b28192d74dc59af52fdc76135","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"tags":["nvd","cve.org"],"epss":0.0016,"epssPercentile":0.0554,"ingestedAt":"2026-09-17T16:21:47.902Z","slug":"CVE-2026-90057","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nslip: remove slip_hangup() to fix use-after-free in slip_receive_buf()\n\nJaeyoung Chung and Eulgyu Kim reported a slab-use-after-free read\nin slip_receive_buf() when racing against tty hangup.\n\ntty_ldisc_hangup() calls ld->ops->hangup() while holding only\na read lock on tty->ldisc_sem (via tty_ldisc_ref()).\nBecause slip_hangup() simply called slip_close(), it ran concurrently\nwith reader functions such as slip_receive_buf().\n\nslip_close() unregisters and frees the net device and its private\nstruct slip, causing concurrent reader threads in slip_receive_buf()\nto dereference freed memory.\n\nLine discipline close() is already guaranteed to be called under\nthe write lock of tty->ldisc_sem during hangup processing\n(in tty_ldisc_reinit() or tty_ldisc_kill()).\n\nRemove slip_hangup() so teardown is serialized cleanly by slip_close().\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":207097,"id":"CVE-2026-90057","ts":1789757331611,"field":"cvss","old":null,"new":"7.8"},{"seq":207096,"id":"CVE-2026-90057","ts":1789757331611,"field":"severity","old":"none","new":"high"}]}