In the Linux kernel, the following vulnerability has been resolved:

net: slip: serialize receive against buffer reallocation

sl_realloc_bufs() replaces rbuff and updates buffsize while holding
sl->lock. slip_receive_buf() reads those fields and writes through rbuff
without holding the lock.

An MTU change can therefore race with receive processing. An MTU shrink
can expose the new smaller rbuff with the old larger bound, causing an
out-of-bounds write. A receive callback which already loaded the old
rbuff can instead continue writing after that buffer has been freed.

Serialize receive processing with sl_realloc_bufs() by holding sl->lock
while consuming each receive batch.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 affected < eb3836eab47487823f362e6985e170a1e15f20fd
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 affected < 44401f7dd9940ced7098930ef64f5a332f279fc2
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 affected < 5d07b178bef511d69558cfc89fe1129258dc39f8
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 affected < 0e37bbd6d617eb52bace49390e99eaedc1af73ce
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 affected < ee7f9bb9320add61f7b367d7e6cd55e3a3a4d65d
Linux Linux affected
Version Status Constraints
2.6.12 affected —
0 unaffected < 2.6.12
6.6.148 unaffected ≤ 6.6.*
6.12.101 unaffected ≤ 6.12.*
6.18.42 unaffected ≤ 6.18.*
7.1.6 unaffected ≤ 7.1.*
7.2-rc5 unaffected ≤ *

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors Products
Linux Subscribe
Linux Kernel Subscribe

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/0e37bbd6d617eb52bace49390e99eaedc1af73ce cve-icon
https://git.kernel.org/stable/c/44401f7dd9940ced7098930ef64f5a332f279fc2 cve-icon
https://git.kernel.org/stable/c/5d07b178bef511d69558cfc89fe1129258dc39f8 cve-icon
https://git.kernel.org/stable/c/eb3836eab47487823f362e6985e170a1e15f20fd cve-icon
https://git.kernel.org/stable/c/ee7f9bb9320add61f7b367d7e6cd55e3a3a4d65d cve-icon
History

Mon, 10 Aug 2026 14:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-119
CWE-122
CWE-362

Mon, 10 Aug 2026 12:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: net: slip: serialize receive against buffer reallocation sl_realloc_bufs() replaces rbuff and updates buffsize while holding sl->lock. slip_receive_buf() reads those fields and writes through rbuff without holding the lock. An MTU change can therefore race with receive processing. An MTU shrink can expose the new smaller rbuff with the old larger bound, causing an out-of-bounds write. A receive callback which already loaded the old rbuff can instead continue writing after that buffer has been freed. Serialize receive processing with sl_realloc_bufs() by holding sl->lock while consuming each receive batch.
Title net: slip: serialize receive against buffer reallocation
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-08-10T11:59:07.354Z

Reserved: 2026-07-30T09:28:09.370Z

Link: CVE-2026-68143

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-10T15:30:05Z

Weaknesses