{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-68143", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-30T09:28:09.370Z", "datePublished": "2026-08-10T11:59:07.354Z", "dateUpdated": "2026-08-19T16:30:04.807Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-19T16:30:04.807Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: slip: serialize receive against buffer reallocation\n\nsl_realloc_bufs() replaces rbuff and updates buffsize while holding\nsl->lock. slip_receive_buf() reads those fields and writes through rbuff\nwithout holding the lock.\n\nAn MTU change can therefore race with receive processing. An MTU shrink\ncan expose the new smaller rbuff with the old larger bound, causing an\nout-of-bounds write. A receive callback which already loaded the old\nrbuff can instead continue writing after that buffer has been freed.\n\nSerialize receive processing with sl_realloc_bufs() by holding sl->lock\nwhile consuming each receive batch." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The bug is in the SLIP TTY line discipline; triggering the MTU shrink/realloc race requires SIOCSIFMTU/RTM_SETLINK (CAP_NET_ADMIN) on the host, so a single attacker must have local access even if SLIP frames arrive over a serial backhaul.\nAC:L - An attacker with CAP_NET_ADMIN can concurrently hammer MTU changes via ioctl/rtnetlink and inject SLIP frames on the bound TTY/PTY, controlling both sides of the race without depending on uncontrollable timing.\nPR:L - SIOCSIFMTU requires CAP_NET_ADMIN in the interface network namespace, obtainable by an unprivileged user via user namespaces; exploitation targets already-active SLIP links and does not repeat slip_open()'s init-namespace check.\nUI:N - No end-user or administrator interaction is required during exploitation once a SLIP interface is active; the attacker drives both MTU reallocation and receive processing directly.\nS:U - Heap corruption is confined to kernel SLIP receive buffers and adjacent kmalloc objects; impact is standard kernel memory corruption and local privilege escalation, not a cross-VM or sandbox boundary escape.\nC:H - The race yields heap out-of-bounds writes and use-after-free writes on freed rbuff kmalloc objects; per kernel guidance, this class of memory corruption enables arbitrary kernel memory disclosure.\nI:H - Writing past the reallocated rbuff boundary or into a freed buffer corrupts adjacent heap metadata/objects, providing primitives for arbitrary kernel writes and control-flow hijacking.\nA:H - Out-of-bounds and use-after-free corruption of kernel heap memory reliably causes kernel oops/panic during the race even when not fully weaponized for code execution." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/slip/slip.c" ], "versions": [ { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "8180daf2b66155f84ec4f9e3f95488c8a3421716", "status": "affected", "versionType": "git" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "189a550eb7e1dc10018718ddfc46d003ffe58653", "status": "affected", "versionType": "git" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "1be09d175b627fad7f6bec7ad27b8a4a99863912", "status": "affected", "versionType": "git" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "eb3836eab47487823f362e6985e170a1e15f20fd", "status": "affected", "versionType": "git" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "44401f7dd9940ced7098930ef64f5a332f279fc2", "status": "affected", "versionType": "git" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "5d07b178bef511d69558cfc89fe1129258dc39f8", "status": "affected", "versionType": "git" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "0e37bbd6d617eb52bace49390e99eaedc1af73ce", "status": "affected", "versionType": "git" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "ee7f9bb9320add61f7b367d7e6cd55e3a3a4d65d", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/slip/slip.c" ], "versions": [ { "version": "2.6.12", "status": "affected" }, { "version": "0", "lessThan": "2.6.12", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.265", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.216", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.183", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.148", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.101", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.42", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.1.6", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "5.10.265" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "5.15.216" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "6.1.183" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "6.6.148" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "6.12.101" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "6.18.42" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "7.1.6" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "7.2" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/8180daf2b66155f84ec4f9e3f95488c8a3421716" }, { "url": "https://git.kernel.org/stable/c/189a550eb7e1dc10018718ddfc46d003ffe58653" }, { "url": "https://git.kernel.org/stable/c/1be09d175b627fad7f6bec7ad27b8a4a99863912" }, { "url": "https://git.kernel.org/stable/c/eb3836eab47487823f362e6985e170a1e15f20fd" }, { "url": "https://git.kernel.org/stable/c/44401f7dd9940ced7098930ef64f5a332f279fc2" }, { "url": "https://git.kernel.org/stable/c/5d07b178bef511d69558cfc89fe1129258dc39f8" }, { "url": "https://git.kernel.org/stable/c/0e37bbd6d617eb52bace49390e99eaedc1af73ce" }, { "url": "https://git.kernel.org/stable/c/ee7f9bb9320add61f7b367d7e6cd55e3a3a4d65d" } ], "title": "net: slip: serialize receive against buffer reallocation", "x_generator": { "engine": "bippy-1.2.0" } } } }