CVE-2026-90057

A flaw was found in the Linux kernel's Serial Line Internet Protocol (SLIP) implementation. A local attacker could exploit a race condition during a tty hangup operation, causing the slip_receive_buf() function to access memory after it has been freed. This use-after-free vulnerability can lead to information disclosure or system instability.

A use-after-free in the SLIP line discipline can occur because slip_hangup calls slip_close while tty hangup processing only holds a read lock on tty ldisc_sem. slip_close unregisters and frees the net device and private struct slip while slip_receive_buf or another reader can still run and dereference the freed object. For the CVSS the PR:L is used for the paranoid score because a local user or constrained service with access to an already configured SLIP tty may be able to race receive_buf against hangup, although creating the SLIP line discipline commonly requires CAP_NET_ADMIN. The issue is not directly network reachable and is triggered through local tty line discipline activity rather than remote packet traffic. Impact is at least local denial of service via kernel crash. In the worst defensible case, the kernel UAF may allow confidentiality or integrity impact and should be reviewed manually.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.