CVE-2026-68135 net: hip04: fix RX buffer leak on build_skb failure
A resource leak in the hip04 network driver allows remote attackers to cause a denial of service by triggering build_skb failures.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-68135?
CVE-2026-68135 is a denial of service vulnerability in Linux, published on 10 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
net: hip04: fix RX buffer leak on build_skb failure
When build_skb() fails in hip04_rx_poll(), the driver jumps to the refill path without releasing the current RX buffer and its DMA mapping. Installing a replacement buffer then overwrites the slot references and leaks both resources.
Keep the current slot intact and return budget so NAPI retries the same buffer. Also free a newly allocated RX fragment when dma_map_single() fails.
This issue was found by an in-house static analysis tool.
Which versions are affected by CVE-2026-68135?
How do I fix CVE-2026-68135?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-68135 being exploited?
There is no known exploitation of CVE-2026-68135 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-68135, DEBIAN-CVE-2026-68135, GHSA-46mx-vfg9-j7vh, UBUNTU-CVE-2026-68135.