---
id: CVE-2026-90057
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  slip: remove slip_hangup() to fix use-after-free in slip_receive_buf()

  Jaeyoung Chung and Eulgyu Kim reported a slab-use-after-free read
  in slip_receive_buf() when rac…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  slip: remove slip_hangup() to fix use-after-free in slip_receive_buf()

  Jaeyoung Chung and Eulgyu Kim reported a slab-use-after-free read
  in slip_receive_buf() when rac…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 5342b77c4123ba39f911d92a813295fb3bb21f69 <
    9a3b1edff1ecb47d323f2506b3ffc22178acd1c6
  - >-
    Linux >= 5342b77c4123ba39f911d92a813295fb3bb21f69 <
    a2dbac3fb03b4427ccf057debc83fc61ee102529
  - >-
    Linux >= 5342b77c4123ba39f911d92a813295fb3bb21f69 <
    de1f978c0f6ab42b28192d74dc59af52fdc76135
  - >-
    Linux >= 5342b77c4123ba39f911d92a813295fb3bb21f69 <
    ddbc5dc5a2e29b3934da09c1ba3c930fd8a40fd6
  - >-
    Linux >= 5342b77c4123ba39f911d92a813295fb3bb21f69 <
    a540a49fcca59d1c92c3a6462e67ca21676a88df
  - >-
    Linux >= 5342b77c4123ba39f911d92a813295fb3bb21f69 <
    23c53269f2baaedf2d92784290cb9ef6db2a3bce
  - Linux 2.6.32
published: '2026-09-17'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T18:17:40.053'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-90057'
references:
  - url: 'https://git.kernel.org/stable/c/23c53269f2baaedf2d92784290cb9ef6db2a3bce'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/9a3b1edff1ecb47d323f2506b3ffc22178acd1c6'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/a2dbac3fb03b4427ccf057debc83fc61ee102529'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/a540a49fcca59d1c92c3a6462e67ca21676a88df'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/ddbc5dc5a2e29b3934da09c1ba3c930fd8a40fd6'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/de1f978c0f6ab42b28192d74dc59af52fdc76135'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
epss: 0.00171
epssPercentile: 0.05713
ingestedAt: '2026-09-17T16:21:47.902Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

slip: remove slip_hangup() to fix use-after-free in slip_receive_buf()

Jaeyoung Chung and Eulgyu Kim reported a slab-use-after-free read
in slip_receive_buf() when racing against tty hangup.

tty_ldisc_hangup() calls ld->ops->hangup() while holding only
a read lock on tty->ldisc_sem (via tty_ldisc_ref()).
Because slip_hangup() simply called slip_close(), it ran concurrently
with reader functions such as slip_receive_buf().

slip_close() unregisters and frees the net device and its private
struct slip, causing concurrent reader threads in slip_receive_buf()
to dereference freed memory.

Line discipline close() is already guaranteed to be called under
the write lock of tty->ldisc_sem during hangup processing
(in tty_ldisc_reinit() or tty_ldisc_kill()).

Remove slip_hangup() so teardown is serialized cleanly by slip_close().

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.