Linux Kernel CVE-2026-68143

The SLIP driver (net/slip/slip.c) in the Linux kernel manages per-interface receive and transmit ring buffers (rbuff, xbuff) that are reallocated when the interface MTU changes. sl_realloc_bufs() acquires the per-interface spinlock sl->lock, swaps in a new smaller or larger rbuff, and updates buffsize atomically from the lock holder's perspective. However, slip_receive_buf() - the TTY layer's receive callback - loads rbuff and buffsize and writes incoming packet data through rbuff without ever acquiring sl->lock. This is a classic TOCTOU (Time-of-Check-Time-of-Use) concurrency defect: if a receive callback loads the old rbuff pointer before the MTU change completes, it proceeds to write into either the freed former buffer (use-after-free) or with the old larger bound against the new smaller buffer (out-of-bounds write). Both primitives represent kernel heap corruption. The CPE cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* and the affected commit range starting from 1da177e4c3f4 (the very first Linux git commit, 2005) indicate essentially all kernel versions are affected. The SLIP subsystem itself is a legacy serial-line networking driver dating to early Unix systems, rarely configured in modern deployments.