CVE-2026-90057

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

The UAF is reached by racing local TTY syscalls: ioctl(TIOCSETD, N_SLIP) then write() on a PTY master into pty_write→tty_insert_flip_string_and_push_buffer→flush_to_ldisc→tty_port_default_receive_buf→slip_receive_buf, while close() of that master runs pty_close→tty_vhangup→tty_ldisc_hangup→slip_hangup. Hangup is a local TTY lifecycle event, not bytes from a remote SLIP peer.

AC:LAttack complexity, low

The attacker owns both PTY fds and can loop write() on the master (driving slip_receive_buf under tty_ldisc_ref()'s read lock) concurrently with close()→pty_close→tty_vhangup→slip_hangup, which tty_ldisc_hangup() also invokes under only a read lock. Because hangup() is not serialized by ldisc_sem's write side, the attacker creates and retries the race.

PR:LPrivileges required, low

Attaching N_SLIP requires slip_open()'s capable(CAP_NET_ADMIN) check, which is ns_capable(&init_user_ns) and is not granted by unshare -Urn. CAP_NET_ADMIN in the initial user namespace is still routinely given to non-root container/network workloads (Docker/K8s --cap-add=NET_ADMIN) without full host root, so privileges required are Low.

UI:NUser interaction, none

The attacker performs every step in its own processes: open("/dev/ptmx"), ioctl(TIOCSETD, N_SLIP), write() to the master, and close() to force pty_close()→tty_vhangup(). No separate victim user or administrator action is required at exploit time.

S:UScope, unchanged

The UAF corrupts the host-kernel net_device allocated in sl_alloc() via alloc_netdev() and its embedded struct slip (netdev_priv). Impact is standard local kernel privilege escalation, not a VM escape or IOMMU/DMA boundary bypass.

C:HConfidentiality impact, high

slip_receive_buf() loads sl from tty->disc_data without an RCU read-side critical section, then reads sl->magic and sl->dev after slip_hangup()→slip_close()→unregister_netdev() has freed that net_device (needs_free_netdev). A use-after-free of this object enables an arbitrary kernel read via heap spray.

I:HIntegrity impact, high

Once past those checks, slip_receive_buf() takes spin_lock_bh(&sl->lock) and slip_unesc() writes sl->rbuff[sl->rcount++] and sl->flags on the already-freed struct slip, giving a write primitive against a net_device that also carries netdev_ops function pointers.

A:HAvailability impact, high

Use-after-free of the SLIP net_device/struct slip causes a kernel oops or panic even when not fully exploited; the report is a KASAN slab-use-after-free read in slip_receive_buf() racing tty hangup.