CVE-2026-68143 Overview
CVE-2026-68143 is a race condition in the Linux kernel's Serial Line Internet Protocol (SLIP) driver. The flaw exists between sl_realloc_bufs() and slip_receive_buf(). The reallocation function updates the receive buffer (rbuff) and buffsize while holding sl->lock, but the receive path reads and writes those fields without acquiring the lock. A concurrent Maximum Transmission Unit (MTU) change can therefore race with receive processing, producing an out-of-bounds write or a use-after-free on the freed buffer.
Critical Impact
A local attacker with the ability to trigger MTU changes on a SLIP interface can corrupt kernel memory, leading to privilege escalation or denial of service.
Affected Products
- Linux kernel (mainline) prior to the fix commit 5d07b178bef5
- Linux stable branches referenced by backport commits 0e37bbd6d617, 44401f7dd994, eb3836eab474, and ee7f9bb9320a
- Systems with the SLIP driver (CONFIG_SLIP) built and loaded
Discovery Timeline
- 2026-08-10 - CVE-2026-68143 published to NVD
- 2026-08-13 - Last updated in NVD database
Technical Details for CVE-2026-68143
Vulnerability Analysis
The SLIP driver maintains a per-device receive buffer (rbuff) and its size (buffsize) inside the struct slip object. When userspace changes the MTU, sl_realloc_bufs() allocates a new buffer, frees the old one, and updates buffsize. This mutation is serialized by sl->lock.
The receive path, slip_receive_buf(), consumes bytes arriving from the underlying tty and writes them into rbuff up to buffsize. This path does not take sl->lock. Two dangerous interleavings become possible.
First, an MTU shrink can expose the newly allocated smaller rbuff while a concurrent receiver still uses the previously loaded buffsize bound. The receiver then writes past the end of the new allocation, producing a kernel heap out-of-bounds write [CWE-787].
Second, a receive callback that loaded the pointer to the old rbuff can continue writing to it after sl_realloc_bufs() has freed that allocation. This yields a use-after-free [CWE-416] on freed slab memory.
Root Cause
The root cause is missing synchronization. sl_realloc_bufs() mutates state under sl->lock, but slip_receive_buf() reads that state and dereferences the pointer without the same lock. The two code paths therefore race whenever an MTU change and inbound serial traffic overlap.
Attack Vector
Exploitation requires local access with permission to configure a SLIP network interface and to inject data on the associated tty. An attacker triggers repeated MTU changes on the SLIP device while a colluding writer transmits framed data on the tty. Winning the race corrupts adjacent slab objects or the freed buffer, giving the attacker a primitive suitable for kernel privilege escalation. The fix serializes receive processing with sl_realloc_bufs() by holding sl->lock while consuming each receive batch. See the upstream fix commit for technical details.
Detection Methods for CVE-2026-68143
Indicators of Compromise
- Unexpected kernel oops or KASAN reports referencing slip_receive_buf or sl_realloc_bufs in dmesg
- Repeated SIOCSIFMTU ioctl activity against SLIP interfaces (sl0, sl1, and similar) from non-administrative processes
- Concurrent ldattach or slattach invocations followed by rapid MTU changes on the same tty
Detection Strategies
- Audit kernel logs for slab corruption, out-of-bounds write, or use-after-free reports involving the SLIP driver
- Monitor auditd records for ioctl calls carrying SIOCSIFMTU targeting SLIP link types
- Alert on unprivileged users acquiring CAP_NET_ADMIN in a namespace where the SLIP driver is loaded
Monitoring Recommendations
- Enable KASAN in test and staging kernels to surface memory-safety regressions in SLIP handling
- Track modprobe slip events and treat SLIP module loading on production servers as anomalous
- Correlate tty line-discipline changes with subsequent MTU updates to detect exploitation attempts
How to Mitigate CVE-2026-68143
Immediate Actions Required
- Apply the upstream fix commit 5d07b178bef5 or the corresponding stable backport for your kernel branch
- Blacklist the slip kernel module on systems that do not require serial-line IP connectivity
- Restrict CAP_NET_ADMIN and tty access so that only trusted operators can configure SLIP interfaces
Patch Information
The fix serializes receive processing against buffer reallocation by acquiring sl->lock while consuming each receive batch. Backports are available in the following kernel Git commits: 0e37bbd6d617, 44401f7dd994, 5d07b178bef5, eb3836eab474, and ee7f9bb9320a. Rebuild and reboot into the patched kernel to remove the race window.
Workarounds
- Prevent the driver from loading by adding blacklist slip to /etc/modprobe.d/ on hosts that do not need SLIP
- Remove CAP_NET_ADMIN from unprivileged users and containers to block MTU changes on SLIP devices
- Avoid dynamically resizing MTU on active SLIP interfaces until the patch is deployed
# Configuration example: disable SLIP driver loading
echo 'blacklist slip' | sudo tee /etc/modprobe.d/disable-slip.conf
sudo rmmod slip 2>/dev/null || true
# Verify the module is no longer loaded
lsmod | grep -E '^slip'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
