CVE-2026-68143 net: slip: serialize receive against buffer reallocation
A race condition in the Linux kernel's SLIP driver allows out-of-bounds writes or use-after-free during MTU changes, potentially leading to code execution or crashes.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-68143?
CVE-2026-68143 is a high-severity vulnerability in Linux, published on 10 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
net: slip: serialize receive against buffer reallocation
sl_realloc_bufs() replaces rbuff and updates buffsize while holding sl->lock. slip_receive_buf() reads those fields and writes through rbuff without holding the lock.
An MTU change can therefore race with receive processing. An MTU shrink can expose the new smaller rbuff with the old larger bound, causing an out-of-bounds write. A receive callback which already loaded the old rbuff can instead continue writing after that buffer has been freed.
Serialize receive processing with sl_realloc_bufs() by holding sl->lock while consuming each receive batch.
Weakness: CWE-362
Which versions are affected by CVE-2026-68143?
How do I fix CVE-2026-68143?
Apply the vendor's patch.
Is CVE-2026-68143 being exploited?
There is no known exploitation of CVE-2026-68143 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-68143, DEBIAN-CVE-2026-68143, GHSA-7xg5-v5hr-7r34, UBUNTU-CVE-2026-68143.