{"id":"CVE-2026-68143","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-68143","summary":"net: slip: serialize receive against buffer reallocation","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: slip: serialize receive against buffer reallocation\n\nsl_realloc_bufs() replaces rbuff and updates buffsize while holding\nsl->lock. slip_receive_buf() reads those fields and writes through rbuff\nwithout holding the lock.\n\nAn MTU change can therefore race with receive processing. An MTU shrink\ncan expose the new smaller rbuff with the old larger bound, causing an\nout-of-bounds write. A receive callback which already loaded the old\nrbuff can instead continue writing after that buffer has been freed.\n\nSerialize receive processing with sl_realloc_bufs() by holding sl->lock\nwhile consuming each receive batch.","published":"2026-08-10T11:59:07.354Z","modified":"2026-08-14T04:02:22.326720243Z","cvss":{"score":7.8,"severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Linux","name":"Kernel","fixedVersion":"6.6.148"}],"fix":null,"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/0e37bbd6d617eb52bace49390e99eaedc1af73ce"},{"type":"WEB","url":"https://git.kernel.org/stable/c/44401f7dd9940ced7098930ef64f5a332f279fc2"},{"type":"WEB","url":"https://git.kernel.org/stable/c/5d07b178bef511d69558cfc89fe1129258dc39f8"},{"type":"WEB","url":"https://git.kernel.org/stable/c/eb3836eab47487823f362e6985e170a1e15f20fd"},{"type":"WEB","url":"https://git.kernel.org/stable/c/ee7f9bb9320add61f7b367d7e6cd55e3a3a4d65d"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68143.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68143"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-14T04:02:22.326720243Z"}}