CVE-2026-45842

slip: reject VJ receive packets on instances with no rstate array

Published May 27, 2026 CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

slip: reject VJ receive packets on instances with no rstate array

slhc_init() accepts rslots == 0 as a valid configuration, with the
documented meaning of 'no receive compression'. In that case the
allocation loop in slhc_init() is skipped, so comp->rstate stays
NULL and comp->rslot_limit stays 0 (from the kzalloc of struct
slcompress).

The receive helpers do not defend against that configuration.
slhc_uncompress() dereferences comp->rstate[x] when the VJ header
carries an explicit connection ID, and slhc_remember() later assigns
cs = &comp->rstate[...] after only comparing the packet's slot number
to comp->rslot_limit. Because rslot_limit is 0, slot 0 passes the
range check, and the code dereferences a NULL rstate.

The configuration is reachable in-tree through PPP. PPPIOCSMAXCID
stores its argument in a signed int, and (val >> 16) uses arithmetic
shift. Passing 0xffff0000 therefore sign-extends to -1, so val2 + 1
is 0 and ppp_generic.c ends up calling slhc_init(0, 1). Because
/dev/ppp open is gated by ns_capable(CAP_NET_ADMIN), the whole path
is reachable from an unprivileged user namespace. Once the malformed
VJ state is installed, any inbound VJ-compressed or VJ-uncompressed
frame that selects slot 0 crashes the kernel in softirq context:

Oops: general protection fault, probably for non-canonical
address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
RIP: 0010:slhc_uncompress (drivers/net/slip/slhc.c:519)
Call Trace:
<TASK>
ppp_receive_nonmp_frame (drivers/net/ppp/ppp_generic.c:2466)
ppp_input (drivers/net/ppp/ppp_generic.c:2359)
ppp_async_process (drivers/net/ppp/ppp_async.c:492)
tasklet_action_common (kernel/softirq.c:926)
handle_softirqs (kernel/softirq.c:623)
run_ksoftirqd (kernel/softirq.c:1055)
smpboot_thread_fn (kernel/smpboot.c:160)
kthread (kernel/kthread.c:436)
ret_from_fork (arch/x86/kernel/process.c:164)
</TASK>

Reject the receive side on such instances instead of touching rstate.
slhc_uncompress() falls through to its existing 'bad' label, which
bumps sls_i_error and enters the toss state. slhc_remember() mirrors
that with an explicit sls_i_error increment followed by slhc_toss();
the sls_i_runt counter is not used here because a missing rstate is
an internal configuration state, not a runt packet.

The transmit path is unaffected: the only in-tree caller that picks
rslots from userspace (ppp_generic.c) still supplies tslots >= 1, and
slip.c always calls slhc_init(16, 16), so comp->tstate remains valid
and slhc_compress() continues to work.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`4ab42d78e37a294ac7bc56901d563c642e03c4ae`	affected	< 3d71c961febddd855d3ae9a519eeb96c8023f430
`4ab42d78e37a294ac7bc56901d563c642e03c4ae`	affected	< 72304fec672e8aac9ee7b9c475db96b37cca8d8d
`4ab42d78e37a294ac7bc56901d563c642e03c4ae`	affected	< 4aa9eca6fda2919027dfd7a7cc69334982d89586
`4ab42d78e37a294ac7bc56901d563c642e03c4ae`	affected	< c6980e8b1a86288167f34966fa5219031999b6f1
`4ab42d78e37a294ac7bc56901d563c642e03c4ae`	affected	< de42f86e2cf5028a97e74c25869d1a962b13c301
`4ab42d78e37a294ac7bc56901d563c642e03c4ae`	affected	< 9e1ff0eead073c4f46d874ad2526b7dda5465faf
`4ab42d78e37a294ac7bc56901d563c642e03c4ae`	affected	< 7b0d9e878ec2b21d99ae8051b3dda59cdb66c152
`4ab42d78e37a294ac7bc56901d563c642e03c4ae`	affected	< e76607442d5b73e1ba6768f501ef815bb58c2c0e
`42fc512469e78939c1e419d3310c47de55bdcbb8`	affected	—
`df085f1cb3acd3d75408ff94f366983873bce7d2`	affected	—
`a1c3860d3c5fc62bd35f089bcb03f18a37242de9`	affected	—
`f82699de104eaf8a7ffc2849a566a94818dd8a3c`	affected	—
`354b254af5c1350de9586af75fe5a821b35bfb33`	affected	—
`5148857f5d4c812cc918cf4627f7880521e987eb`	affected	—
`82185755d90c8047c6f4b589c39998ff3d4ca3ad`	affected	—
`a50a93cc99286dc444c7e5ccc7dfb9d58c2d346d`	affected	—
`6b4fa561e26526c62636414d267342c945084f44`	affected	—
`2.6.32.70`	affected	< 2.6.33
`3.2.75`	affected	< 3.3
`3.4.111`	affected	< 3.5
`3.10.96`	affected	< 3.11
`3.12.53`	affected	< 3.13
`3.14.60`	affected	< 3.15
`3.18.27`	affected	< 3.19
`4.1.17`	affected	< 4.2
`4.3.5`	affected	< 4.4

Linux

affected

Version	Status	Constraints
`4.4`	affected	—
`0`	unaffected	< 4.4
`5.10.258`	unaffected	≤ 5.10.*
`5.15.209`	unaffected	≤ 5.15.*
`6.1.175`	unaffected	≤ 6.1.*
`6.6.141`	unaffected	≤ 6.6.*
`6.12.91`	unaffected	≤ 6.12.*
`6.18.33`	unaffected	≤ 6.18.*
`7.0.10`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[4ab42d78e37a294ac7bc56901d563c642e03c4ae,c6980e8b1a86288167f34966fa5219031999b6f1)`	affected	code_commit	—
`[4ab42d78e37a294ac7bc56901d563c642e03c4ae,de42f86e2cf5028a97e74c25869d1a962b13c301)`	affected	code_commit	—
`[4ab42d78e37a294ac7bc56901d563c642e03c4ae,9e1ff0eead073c4f46d874ad2526b7dda5465faf)`	affected	code_commit	—
`[4ab42d78e37a294ac7bc56901d563c642e03c4ae,7b0d9e878ec2b21d99ae8051b3dda59cdb66c152)`	affected	code_commit	—
`[4ab42d78e37a294ac7bc56901d563c642e03c4ae,e76607442d5b73e1ba6768f501ef815bb58c2c0e)`	affected	code_commit	—
`42fc512469e78939c1e419d3310c47de55bdcbb8`	affected	code_commit	—
`df085f1cb3acd3d75408ff94f366983873bce7d2`	affected	code_commit	—
`a1c3860d3c5fc62bd35f089bcb03f18a37242de9`	affected	code_commit	—
`f82699de104eaf8a7ffc2849a566a94818dd8a3c`	affected	code_commit	—
`354b254af5c1350de9586af75fe5a821b35bfb33`	affected	code_commit	—
`5148857f5d4c812cc918cf4627f7880521e987eb`	affected	code_commit	—
`82185755d90c8047c6f4b589c39998ff3d4ca3ad`	affected	code_commit	—
`a50a93cc99286dc444c7e5ccc7dfb9d58c2d346d`	affected	code_commit	—
`6b4fa561e26526c62636414d267342c945084f44`	affected	code_commit	—
`[2.6.32.70,2.6.33)`	affected	generic	—
`[3.2.75,3.3)`	affected	generic	—
`[3.4.111,3.5)`	affected	generic	—
`[3.10.96,3.11)`	affected	generic	—
`[3.12.53,3.13)`	affected	generic	—
`[3.14.60,3.15)`	affected	generic	—
`[3.18.27,3.19)`	affected	generic	—
`[4.1.17,4.2)`	affected	generic	—
`[4.3.5,4.4)`	affected	generic	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`4.4`	affected	generic	—
`[0,4.4)`	unaffected	generic	—
`[6.6.141,6.6.*]`	unaffected	generic	—
`[6.12.91,6.12.*]`	unaffected	generic	—
`[6.18.33,6.18.*]`	unaffected	generic	—
`[7.0.10,7.0.*]`	unaffected	generic	—
`[7.1-rc1,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4664-1	linux security update
Debian DLA	DLA-4665-1	linux security update
Debian DLA	DLA-4671-1	linux-6.1 security update
Debian DSA	DSA-6355-1	linux security update
Ubuntu USN	USN-8566-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8567-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8568-1	Linux kernel (OEM) vulnerabilities
Ubuntu USN	USN-8569-1	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-8574-1	Linux kernel (GCP FIPS) vulnerabilities
Ubuntu USN	USN-8575-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8576-1	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8593-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8574-2	Linux kernel vulnerabilities
Ubuntu USN	USN-8595-1	Linux kernel (Oracle) vulnerabilities
Ubuntu USN	USN-8596-1	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8575-2	Linux kernel vulnerabilities
Ubuntu USN	USN-8576-2	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8597-1	Linux kernel (IBM) vulnerabilities
Ubuntu USN	USN-8575-3	Linux kernel vulnerabilities
Ubuntu USN	USN-8595-2	Linux kernel (AWS) vulnerabilities
Ubuntu USN	USN-8603-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8606-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8607-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8608-1	Linux kernel (Azure FIPS) vulnerabilities
Ubuntu USN	USN-8609-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8610-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8574-3	Linux kernel vulnerabilities
Ubuntu USN	USN-8595-3	Linux kernel (AWS) vulnerabilities
Ubuntu USN	USN-8618-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8619-1	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-8620-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8620-2	Linux kernel (Azure FIPS) vulnerabilities
Ubuntu USN	USN-8620-3	Linux kernel (Intel IoTG) vulnerabilities
Ubuntu USN	USN-8620-4	Linux kernel (Intel IoTG) vulnerabilities
Ubuntu USN	USN-8663-1	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8664-1	Linux kernel (NVIDIA BaseOS) vulnerabilities
Ubuntu USN	USN-8665-1	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-8668-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8728-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8668-2	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-8728-2	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8728-3	Linux kernel (Oracle) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.129% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://cert-portal.siemens.com/productcert/html/ssa-784472.html
https://git.kernel.org/stable/c/3d71c961febddd855d3ae9a519eeb96c8023f430
https://git.kernel.org/stable/c/4aa9eca6fda2919027dfd7a7cc69334982d89586
https://git.kernel.org/stable/c/72304fec672e8aac9ee7b9c475db96b37cca8d8d
https://git.kernel.org/stable/c/7b0d9e878ec2b21d99ae8051b3dda59cdb66c152
https://git.kernel.org/stable/c/9e1ff0eead073c4f46d874ad2526b7dda5465faf
https://git.kernel.org/stable/c/c6980e8b1a86288167f34966fa5219031999b6f1
https://git.kernel.org/stable/c/de42f86e2cf5028a97e74c25869d1a962b13c301
https://git.kernel.org/stable/c/e76607442d5b73e1ba6768f501ef815bb58c2c0e
https://lore.kernel.org/linux-cve-announce/2026052712-CVE-2026-45842-71fc@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-45842
https://www.cve.org/CVERecord?id=CVE-2026-45842

History

Nov 7, 2026 7:30 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Oct 15, 2026 2:30 AM Added references View changes

Type	Values Removed	Values Added
References		https://cert-portal.siemens.com/productcert/html/ssa-784472.html

Jun 1, 2026 5:00 PM Added references View changes

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/3d71c961febddd855d3ae9a519eeb96c8023f430 https://git.kernel.org/stable/c/4aa9eca6fda2919027dfd7a7cc69334982d89586 https://git.kernel.org/stable/c/72304fec672e8aac9ee7b9c475db96b37cca8d8d

May 28, 2026 12:15 AM Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2026052712-CVE-2026-45842-71fc@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-45842 https://www.cve.org/CVERecord?id=CVE-2026-45842
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

May 27, 2026 12:15 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-476

May 27, 2026 10:30 AM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: slip: reject VJ receive packets on instances with no rstate array slhc_init() accepts rslots == 0 as a valid configuration, with the documented meaning of 'no receive compression'. In that case the allocation loop in slhc_init() is skipped, so comp->rstate stays NULL and comp->rslot_limit stays 0 (from the kzalloc of struct slcompress). The receive helpers do not defend against that configuration. slhc_uncompress() dereferences comp->rstate[x] when the VJ header carries an explicit connection ID, and slhc_remember() later assigns cs = &comp->rstate[...] after only comparing the packet's slot number to comp->rslot_limit. Because rslot_limit is 0, slot 0 passes the range check, and the code dereferences a NULL rstate. The configuration is reachable in-tree through PPP. PPPIOCSMAXCID stores its argument in a signed int, and (val >> 16) uses arithmetic shift. Passing 0xffff0000 therefore sign-extends to -1, so val2 + 1 is 0 and ppp_generic.c ends up calling slhc_init(0, 1). Because /dev/ppp open is gated by ns_capable(CAP_NET_ADMIN), the whole path is reachable from an unprivileged user namespace. Once the malformed VJ state is installed, any inbound VJ-compressed or VJ-uncompressed frame that selects slot 0 crashes the kernel in softirq context: Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:slhc_uncompress (drivers/net/slip/slhc.c:519) Call Trace: <TASK> ppp_receive_nonmp_frame (drivers/net/ppp/ppp_generic.c:2466) ppp_input (drivers/net/ppp/ppp_generic.c:2359) ppp_async_process (drivers/net/ppp/ppp_async.c:492) tasklet_action_common (kernel/softirq.c:926) handle_softirqs (kernel/softirq.c:623) run_ksoftirqd (kernel/softirq.c:1055) smpboot_thread_fn (kernel/smpboot.c:160) kthread (kernel/kthread.c:436) ret_from_fork (arch/x86/kernel/process.c:164) </TASK> Reject the receive side on such instances instead of touching rstate. slhc_uncompress() falls through to its existing 'bad' label, which bumps sls_i_error and enters the toss state. slhc_remember() mirrors that with an explicit sls_i_error increment followed by slhc_toss(); the sls_i_runt counter is not used here because a missing rstate is an internal configuration state, not a runt packet. The transmit path is unaffected: the only in-tree caller that picks rslots from userspace (ppp_generic.c) still supplies tslots >= 1, and slip.c always calls slhc_init(16, 16), so comp->tstate remains valid and slhc_compress() continues to work.
Title		slip: reject VJ receive packets on instances with no rstate array
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/7b0d9e878ec2b21d99ae8051b3dda59cdb66c152 https://git.kernel.org/stable/c/9e1ff0eead073c4f46d874ad2526b7dda5465faf https://git.kernel.org/stable/c/c6980e8b1a86288167f34966fa5219031999b6f1 https://git.kernel.org/stable/c/de42f86e2cf5028a97e74c25869d1a962b13c301 https://git.kernel.org/stable/c/e76607442d5b73e1ba6768f501ef815bb58c2c0e