CVE-2026-68143
Description
In the Linux kernel, the following vulnerability has been resolved: net: slip: serialize receive against buffer reallocation sl_realloc_bufs() replaces rbuff and updates buffsize while holding sl->lock. slip_receive_buf() reads those fields and writes through rbuff without holding the lock. An MTU change can therefore race with receive processing. An MTU shrink can expose the new smaller rbuff with the old larger bound, causing an out-of-bounds write. A receive callback which already loaded the old rbuff can instead continue writing after that buffer has been freed. Serialize receive processing with sl_realloc_bufs() by holding sl->lock while consuming each receive batch.
How to fix
- Linux Linux8180daf2b66155f84ec4f9e3f95488c8a3421716, 189a550eb7e1dc10018718ddfc46d003ffe58653, 1be09d175b627fad7f6bec7ad27b8a4a99863912, eb3836eab47487823f362e6985e170a1e15f20fd, 44401f7dd9940ced7098930ef64f5a332f279fc2, 5d07b178bef511d69558cfc89fe1129258dc39f8, 0e37bbd6d617eb52bace49390e99eaedc1af73ce, ee7f9bb9320add61f7b367d7e6cd55e3a3a4d65d or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 ≤ v < 8180daf2b66155f84ec4f9e3f95488c8a3421716, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 ≤ v < 189a550eb7e1dc10018718ddfc46d003ffe58653, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 ≤ v < 1be09d175b627fad7f6bec7ad27b8a4a99863912, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 ≤ v < eb3836eab47487823f362e6985e170a1e15f20fd, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 ≤ v < 44401f7dd9940ced7098930ef64f5a332f279fc2, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 ≤ v < 5d07b178bef511d69558cfc89fe1129258dc39f8, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 ≤ v < 0e37bbd6d617eb52bace49390e99eaedc1af73ce, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 ≤ v < ee7f9bb9320add61f7b367d7e6cd55e3a3a4d65d, 2.6.12 | 8180daf2b66155f84ec4f9e3f95488c8a3421716, 189a550eb7e1dc10018718ddfc46d003ffe58653, 1be09d175b627fad7f6bec7ad27b8a4a99863912, eb3836eab47487823f362e6985e170a1e15f20fd, 44401f7dd9940ced7098930ef64f5a332f279fc2, 5d07b178bef511d69558cfc89fe1129258dc39f8, 0e37bbd6d617eb52bace49390e99eaedc1af73ce, ee7f9bb9320add61f7b367d7e6cd55e3a3a4d65d |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.