{"id":"CVE-2026-90057","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nslip: remove slip_hangup() to fix use-after-free in slip_receive_buf()\n\nJaeyoung Chung and Eulgyu Kim reported a slab-use-after-free read\nin slip_receive_buf() when rac…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nslip: remove slip_hangup() to fix use-after-free in slip_receive_buf()\n\nJaeyoung Chung and Eulgyu Kim reported a slab-use-after-free read\nin slip_receive_buf() when rac…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","vendor":"Linux","product":"Linux","affected":["Linux >= 5342b77c4123ba39f911d92a813295fb3bb21f69 < 9a3b1edff1ecb47d323f2506b3ffc22178acd1c6","Linux >= 5342b77c4123ba39f911d92a813295fb3bb21f69 < a2dbac3fb03b4427ccf057debc83fc61ee102529","Linux >= 5342b77c4123ba39f911d92a813295fb3bb21f69 < de1f978c0f6ab42b28192d74dc59af52fdc76135","Linux >= 5342b77c4123ba39f911d92a813295fb3bb21f69 < ddbc5dc5a2e29b3934da09c1ba3c930fd8a40fd6","Linux >= 5342b77c4123ba39f911d92a813295fb3bb21f69 < a540a49fcca59d1c92c3a6462e67ca21676a88df","Linux >= 5342b77c4123ba39f911d92a813295fb3bb21f69 < 23c53269f2baaedf2d92784290cb9ef6db2a3bce","Linux 2.6.32"],"published":"2026-09-17","updated":"2026-09-18","sourceUpdated":"2026-09-18T18:17:40.053","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-90057","references":[{"url":"https://git.kernel.org/stable/c/23c53269f2baaedf2d92784290cb9ef6db2a3bce","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9a3b1edff1ecb47d323f2506b3ffc22178acd1c6","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a2dbac3fb03b4427ccf057debc83fc61ee102529","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a540a49fcca59d1c92c3a6462e67ca21676a88df","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ddbc5dc5a2e29b3934da09c1ba3c930fd8a40fd6","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/de1f978c0f6ab42b28192d74dc59af52fdc76135","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-90057.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-90057"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2536437"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-90057"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90057"},{"url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-90057.mbox"},{"url":"https://kernelcve.org/list/?q=CVE-2026-90057"}],"tags":["nvd","cve.org","csaf","vex","red-hat","score-dispute"],"epss":0.00164,"epssPercentile":0.05552,"ingestedAt":"2026-09-17T16:21:47.902Z","cwe":["CWE-825","CWE-416"],"scores":{"nvd":7.8,"vendor":4.7},"slug":"CVE-2026-90057","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nslip: remove slip_hangup() to fix use-after-free in slip_receive_buf()\n\nJaeyoung Chung and Eulgyu Kim reported a slab-use-after-free read\nin slip_receive_buf() when racing against tty hangup.\n\ntty_ldisc_hangup() calls ld->ops->hangup() while holding only\na read lock on tty->ldisc_sem (via tty_ldisc_ref()).\nBecause slip_hangup() simply called slip_close(), it ran concurrently\nwith reader functions such as slip_receive_buf().\n\nslip_close() unregisters and frees the net device and its private\nstruct slip, causing concurrent reader threads in slip_receive_buf()\nto dereference freed memory.\n\nLine discipline close() is already guaranteed to be called under\nthe write lock of tty->ldisc_sem during hangup processing\n(in tty_ldisc_reinit() or tty_ldisc_kill()).\n\nRemove slip_hangup() so teardown is serialized cleanly by slip_close().\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, … · updated 2026-10-25 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-90057.json)","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":207097,"id":"CVE-2026-90057","ts":1789757331611,"field":"cvss","old":null,"new":"7.8"},{"seq":207096,"id":"CVE-2026-90057","ts":1789757331611,"field":"severity","old":"none","new":"high"}]}