CVE-2026-81001

A flaw was found in the Linux kernel's Serial Line Internet Protocol (SLIP) driver. A race condition in the sl_sync() function allows for a use-after-free vulnerability, where the driver attempts to access a network device pointer after it has been freed. A local attacker could exploit this to cause a denial of service, leading to a system crash.

A race in the SLIP driver can leave a stale net_device pointer visible in the slip_devs table while netdev_run_todo() runs priv_destructor and releases the device without RTNL serialization. A local attacker can trigger the race by repeatedly opening a pseudo tty, switching it to the N_SLIP line discipline, and closing it, causing sl_sync() or slip_open() to dereference freed memory. For the CVSS the PR:L is used because reliable triggering requires local code execution and likely network administration capability such as CAP_NET_ADMIN, but not full host root in all delegated or containerized environments. The issue is not network reachable through packet traffic and is triggered through a local tty control path.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.