CVE-2026-68143

CVE-2026-68143 in the Linux kernel SLIP driver contains two distinct race conditions that should be evaluated as separate exploitation paths, not a single severity-weighted issue. The first is an out-of-bounds write triggered when an MTU shrink updates the buffer pointer to a smaller allocation while leaving the original bound tracking intact. An attacker controlling receive timing could write past a reduced buffer's boundary into adjacent kernel heap memory — a spatial corruption that depends on precise MTU change timing during active reception. The second is a use-after-free: a receive callback that has already loaded the old rbuff pointer continues writing after sl_realloc_bufs() has freed that buffer and installed a replacement. This is the more dangerous path because the attacker already controls the buffer contents through the same SLIP interface. They feed controlled data in, trigger the race, and the kernel heap rotation during reallocation does the rest. That's not exploitation preparation — it's exploitation execution through a single race trigger. The patch holds sl->lock throughout receive batch processing, serializing buffer consumption against reallocation. This addresses both modes but raises a performance question: on SLIP interfaces carrying high-volume tunnel traffic, lock contention could introduce latency spikes that resemble legitimate congestion or enable traffic analysis. Whether this matters depends on your deployment — SLIP over tunnels (PPP over SSH, serial-over-IP) is more common than often assumed, particularly in embedded and hybrid infrastructure. The CVSS of 7.8 (high) versus an EPSS of 0.00138 (very low) warrants attention, but don't mistake low EPSS for safety. SLIP is a functionally deprecated subsystem in forgotten code paths — exactly the sediment layer where quiet exploitation accumulates. The low EPSS likely reflects obscurity, not impracticality. Researchers have published the primitives; the question is patch velocity in a subsystem with limited active maintainership. Apply the fix promptly, especially on any system exposing SLIP interfaces to untrusted input or using SLIP for tunnel endpoints.

Reviewed through automated stages and approved by a human before publication.