CVE-2026-90057
In the Linux kernel, the following vulnerability has been resolved:
slip: remove slip_hangup() to fix use-after-free in slip_receive_buf()
Jaeyoung Chung and Eulgyu Kim reported a slab-use-after-free read in slip_receive_buf() when racing against tty hangup.
tty_ldisc_hangup() calls ld->ops->hangup() while holding only a read lock on tty->ldisc_sem (via tty_ldisc_ref()). Because slip_hangup() simply called slip_close(), it ran concurrently with reader functions such as slip_receive_buf().
slip_close() unregisters and frees the net device and its private struct slip, causing concurrent reader threads in slip_receive_buf() to dereference freed memory.
Leer descripción completaMostrar menos
Line discipline close() is already guaranteed to be called under the write lock of tty->ldisc_sem during hangup processing (in tty_ldisc_reinit() or tty_ldisc_kill()).
Remove slip_hangup() so teardown is serialized cleanly by slip_close().
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Puntuación base: 7.8
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.17%
- Percentil entre todas las CVEs puntuadas: 6
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
🎯 Técnicas ATT&CK
Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.
- Explotación
T1068Exploitation for Privilege Escalationprivilege escalation85 % - Impacto principal
T1499.004Application or System Exploitationimpact75 % - Impacto secundario
T1005Data from Local Systemcollection60 %
Vulnerabilidad local de use-after-free en controlador slip del kernel Linux (AV:L, PR:L). Permite escalada de privilegios mediante race condition. Impacta disponibilidad (DoS por crash) y confidencialidad (lectura de memoria liberada).
Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.
🛡️ Mitigaciones ATT&CK que cubren estas técnicas
Tecnologías afectadas (1)
⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.
Referencias
- https://git.kernel.org/stable/c/23c53269f2baaedf2d92784290cb9ef6db2a3bce
- https://git.kernel.org/stable/c/9a3b1edff1ecb47d323f2506b3ffc22178acd1c6
- https://git.kernel.org/stable/c/a2dbac3fb03b4427ccf057debc83fc61ee102529
- https://git.kernel.org/stable/c/a540a49fcca59d1c92c3a6462e67ca21676a88df
- https://git.kernel.org/stable/c/ddbc5dc5a2e29b3934da09c1ba3c930fd8a40fd6
- https://git.kernel.org/stable/c/de1f978c0f6ab42b28192d74dc59af52fdc76135
JSON original (NVD)
Mostrar
{
"id": "CVE-2026-90057",
"cveTags": [],
"metrics": {
"cvssMetricV31": [
{
"type": "Secondary",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 7.8,
"attackVector": "LOCAL",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "LOW",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 1.8
}
]
},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "5342b77c4123ba39f911d92a813295fb3bb21f69",
"lessThan": "9a3b1edff1ecb47d323f2506b3ffc22178acd1c6",
"versionType": "git"
},
{
"status": "affected",
"version": "5342b77c4123ba39f911d92a813295fb3bb21f69",
"lessThan": "a2dbac3fb03b4427ccf057debc83fc61ee102529",
"versionType": "git"
},
{
"status": "affected",
"version": "5342b77c4123ba39f911d92a813295fb3bb21f69",
"lessThan": "de1f978c0f6ab42b28192d74dc59af52fdc76135",
"versionType": "git"
},
{
"status": "affected",
"version": "5342b77c4123ba39f911d92a813295fb3bb21f69",
"lessThan": "ddbc5dc5a2e29b3934da09c1ba3c930fd8a40fd6",
"versionType": "git"
},
{
"status": "affected",
"version": "5342b77c4123ba39f911d92a813295fb3bb21f69",
"lessThan": "a540a49fcca59d1c92c3a6462e67ca21676a88df",
"versionType": "git"
},
{
"status": "affected",
"version": "5342b77c4123ba39f911d92a813295fb3bb21f69",
"lessThan": "23c53269f2baaedf2d92784290cb9ef6db2a3bce",
"versionType": "git"
}
],
"programFiles": [
"drivers/net/slip/slip.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.32"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "2.6.32",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.1.188",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.157",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.110",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/net/slip/slip.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2026-09-17T17:16:54.310",
"references": [
{
"url": "https://git.kernel.org/stable/c/23c53269f2baaedf2d92784290cb9ef6db2a3bce",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/9a3b1edff1ecb47d323f2506b3ffc22178acd1c6",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/a2dbac3fb03b4427ccf057debc83fc61ee102529",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/a540a49fcca59d1c92c3a6462e67ca21676a88df",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/ddbc5dc5a2e29b3934da09c1ba3c930fd8a40fd6",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/de1f978c0f6ab42b28192d74dc59af52fdc76135",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nslip: remove slip_hangup() to fix use-after-free in slip_receive_buf()\n\nJaeyoung Chung and Eulgyu Kim reported a slab-use-after-free read\nin slip_receive_buf() when racing against tty hangup.\n\ntty_ldisc_hangup() calls ld->ops->hangup() while holding only\na read lock on tty->ldisc_sem (via tty_ldisc_ref()).\nBecause slip_hangup() simply called slip_close(), it ran concurrently\nwith reader functions such as slip_receive_buf().\n\nslip_close() unregisters and frees the net device and its private\nstruct slip, causing concurrent reader threads in slip_receive_buf()\nto dereference freed memory.\n\nLine discipline close() is already guaranteed to be called under\nthe write lock of tty->ldisc_sem during hangup processing\n(in tty_ldisc_reinit() or tty_ldisc_kill()).\n\nRemove slip_hangup() so teardown is serialized cleanly by slip_close()."
}
],
"lastModified": "2026-09-18T18:17:40.053",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}