CVE-2026-45842 - Vulnerability Details

- slip: reject VJ receive packets on instances with no rstate array

Description

In the Linux kernel, the following vulnerability has been resolved:

slip: reject VJ receive packets on instances with no rstate array

slhc_init() accepts rslots == 0 as a valid configuration, with the
documented meaning of 'no receive compression'. In that case the
allocation loop in slhc_init() is skipped, so comp->rstate stays
NULL and comp->rslot_limit stays 0 (from the kzalloc of struct
slcompress).

The receive helpers do not defend against that configuration.
slhc_uncompress() dereferences comp->rstate[x] when the VJ header
carries an explicit connection ID, and slhc_remember() later assigns
cs = &comp->rstate[...] after only comparing the packet's slot number
to comp->rslot_limit. Because rslot_limit is 0, slot 0 passes the
range check, and the code dereferences a NULL rstate.

The configuration is reachable in-tree through PPP. PPPIOCSMAXCID
stores its argument in a signed int, and (val >> 16) uses arithmetic
shift. Passing 0xffff0000 therefore sign-extends to -1, so val2 + 1
is 0 and ppp_generic.c ends up calling slhc_init(0, 1). Because
/dev/ppp open is gated by ns_capable(CAP_NET_ADMIN), the whole path
is reachable from an unprivileged user namespace. Once the malformed
VJ state is installed, any inbound VJ-compressed or VJ-uncompressed
frame that selects slot 0 crashes the kernel in softirq context:

Oops: general protection fault, probably for non-canonical
address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
RIP: 0010:slhc_uncompress (drivers/net/slip/slhc.c:519)
Call Trace:
<TASK>
ppp_receive_nonmp_frame (drivers/net/ppp/ppp_generic.c:2466)
ppp_input (drivers/net/ppp/ppp_generic.c:2359)
ppp_async_process (drivers/net/ppp/ppp_async.c:492)
tasklet_action_common (kernel/softirq.c:926)
handle_softirqs (kernel/softirq.c:623)
run_ksoftirqd (kernel/softirq.c:1055)
smpboot_thread_fn (kernel/smpboot.c:160)
kthread (kernel/kthread.c:436)
ret_from_fork (arch/x86/kernel/process.c:164)
</TASK>

Reject the receive side on such instances instead of touching rstate.
slhc_uncompress() falls through to its existing 'bad' label, which
bumps sls_i_error and enters the toss state. slhc_remember() mirrors
that with an explicit sls_i_error increment followed by slhc_toss();
the sls_i_runt counter is not used here because a missing rstate is
an internal configuration state, not a runt packet.

The transmit path is unaffected: the only in-tree caller that picks
rslots from userspace (ppp_generic.c) still supplies tslots >= 1, and
slip.c always calls slhc_init(16, 16), so comp->tstate remains valid
and slhc_compress() continues to work.

Published: 2026-05-27

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel’s slip interface contains a flaw in the initialization of receive compression state. When an instance is misconfigured with zero receive slots, the state array remains null. Subsequent packet handling functions later dereference this null pointer when processing VJ‑compressed frames, causing a general protection fault and an kernel Oops in softirq context. This results in a kernel panic or service interruption for the affected host.

Affected Systems

Any Linux kernel that implements the SLIP driver, including all mainstream distributions, is vulnerable until the patch that detects the missing rstate array and rejects receive packets on such instances is applied. The issue is reachable through PPP user space interactions, such as the PPPIOCSMAXCID ioctl, which can configure the driver with zero slots from an unprivileged user namespace.

Risk and Exploitability

The CVSS score of 5.5 indicates moderate severity for this vulnerability. Due to the kernel crash caused by a null‑pointer dereference in slhc_uncompress, the vulnerability can lead to a denial of service. This crash is triggered by malformed VJ frames that can be sent via the PPP interface. Although access to /dev/ppp requires CAP_NET_ADMIN, the problematic code path can be reached from an unprivileged user namespace, so the risk is high for systems that expose PPP functionality. The EPSS score is below 1%, and the vulnerability is not listed in the CISA KEV catalog.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`4ab42d78e37a294ac7bc56901d563c642e03c4ae`	affected	< 3d71c961febddd855d3ae9a519eeb96c8023f430
`4ab42d78e37a294ac7bc56901d563c642e03c4ae`	affected	< 72304fec672e8aac9ee7b9c475db96b37cca8d8d
`4ab42d78e37a294ac7bc56901d563c642e03c4ae`	affected	< 4aa9eca6fda2919027dfd7a7cc69334982d89586
`4ab42d78e37a294ac7bc56901d563c642e03c4ae`	affected	< c6980e8b1a86288167f34966fa5219031999b6f1
`4ab42d78e37a294ac7bc56901d563c642e03c4ae`	affected	< de42f86e2cf5028a97e74c25869d1a962b13c301
`4ab42d78e37a294ac7bc56901d563c642e03c4ae`	affected	< 9e1ff0eead073c4f46d874ad2526b7dda5465faf
`4ab42d78e37a294ac7bc56901d563c642e03c4ae`	affected	< 7b0d9e878ec2b21d99ae8051b3dda59cdb66c152
`4ab42d78e37a294ac7bc56901d563c642e03c4ae`	affected	< e76607442d5b73e1ba6768f501ef815bb58c2c0e
`42fc512469e78939c1e419d3310c47de55bdcbb8`	affected	—
`df085f1cb3acd3d75408ff94f366983873bce7d2`	affected	—
`a1c3860d3c5fc62bd35f089bcb03f18a37242de9`	affected	—
`f82699de104eaf8a7ffc2849a566a94818dd8a3c`	affected	—
`354b254af5c1350de9586af75fe5a821b35bfb33`	affected	—
`5148857f5d4c812cc918cf4627f7880521e987eb`	affected	—
`82185755d90c8047c6f4b589c39998ff3d4ca3ad`	affected	—
`a50a93cc99286dc444c7e5ccc7dfb9d58c2d346d`	affected	—
`6b4fa561e26526c62636414d267342c945084f44`	affected	—
`2.6.32.70`	affected	< 2.6.33
`3.2.75`	affected	< 3.3
`3.4.111`	affected	< 3.5
`3.10.96`	affected	< 3.11
`3.12.53`	affected	< 3.13
`3.14.60`	affected	< 3.15
`3.18.27`	affected	< 3.19
`4.1.17`	affected	< 4.2
`4.3.5`	affected	< 4.4

Linux

affected

Version	Status	Constraints
`4.4`	affected	—
`0`	unaffected	< 4.4
`5.10.258`	unaffected	≤ 5.10.*
`5.15.209`	unaffected	≤ 5.15.*
`6.1.175`	unaffected	≤ 6.1.*
`6.6.141`	unaffected	≤ 6.6.*
`6.12.91`	unaffected	≤ 6.12.*
`6.18.33`	unaffected	≤ 6.18.*
`7.0.10`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[4ab42d78e37a294ac7bc56901d563c642e03c4ae,c6980e8b1a86288167f34966fa5219031999b6f1)`	affected	code_commit	—
`[4ab42d78e37a294ac7bc56901d563c642e03c4ae,de42f86e2cf5028a97e74c25869d1a962b13c301)`	affected	code_commit	—
`[4ab42d78e37a294ac7bc56901d563c642e03c4ae,9e1ff0eead073c4f46d874ad2526b7dda5465faf)`	affected	code_commit	—
`[4ab42d78e37a294ac7bc56901d563c642e03c4ae,7b0d9e878ec2b21d99ae8051b3dda59cdb66c152)`	affected	code_commit	—
`[4ab42d78e37a294ac7bc56901d563c642e03c4ae,e76607442d5b73e1ba6768f501ef815bb58c2c0e)`	affected	code_commit	—
`42fc512469e78939c1e419d3310c47de55bdcbb8`	affected	code_commit	—
`df085f1cb3acd3d75408ff94f366983873bce7d2`	affected	code_commit	—
`a1c3860d3c5fc62bd35f089bcb03f18a37242de9`	affected	code_commit	—
`f82699de104eaf8a7ffc2849a566a94818dd8a3c`	affected	code_commit	—
`354b254af5c1350de9586af75fe5a821b35bfb33`	affected	code_commit	—
`5148857f5d4c812cc918cf4627f7880521e987eb`	affected	code_commit	—
`82185755d90c8047c6f4b589c39998ff3d4ca3ad`	affected	code_commit	—
`a50a93cc99286dc444c7e5ccc7dfb9d58c2d346d`	affected	code_commit	—
`6b4fa561e26526c62636414d267342c945084f44`	affected	code_commit	—
`[2.6.32.70,2.6.33)`	affected	generic	—
`[3.2.75,3.3)`	affected	generic	—
`[3.4.111,3.5)`	affected	generic	—
`[3.10.96,3.11)`	affected	generic	—
`[3.12.53,3.13)`	affected	generic	—
`[3.14.60,3.15)`	affected	generic	—
`[3.18.27,3.19)`	affected	generic	—
`[4.1.17,4.2)`	affected	generic	—
`[4.3.5,4.4)`	affected	generic	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.4`	affected	generic	—
`[0,4.4)`	unaffected	generic	—
`[6.6.141,6.6.*]`	unaffected	generic	—
`[6.12.91,6.12.*]`	unaffected	generic	—
`[6.18.33,6.18.*]`	unaffected	generic	—
`[7.0.10,7.0.*]`	unaffected	generic	—
`[7.1-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the latest Linux kernel update that includes the slhc_uncompress and slhc_remember null‑pointer checks.
If immediate patching is not possible, disable the VJ compression feature for PPP connections by setting appropriate configurations or using network filters to block receipt of VJ‑compressed frames.
Ensure that any PPP daemons or services are not configured with receive slot values of zero; enforce a minimum of one slot during runtime configuration.

Generated by OpenCVE AI on May 28, 2026 at 02:04 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00164.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/3d71c961febddd855d3ae9a519eeb96c8023f430
https://git.kernel.org/stable/c/4aa9eca6fda2919027dfd7a7cc69334982d89586
https://git.kernel.org/stable/c/72304fec672e8aac9ee7b9c475db96b37cca8d8d
https://git.kernel.org/stable/c/7b0d9e878ec2b21d99ae8051b3dda59cdb66c152
https://git.kernel.org/stable/c/9e1ff0eead073c4f46d874ad2526b7dda5465faf
https://git.kernel.org/stable/c/c6980e8b1a86288167f34966fa5219031999b6f1
https://git.kernel.org/stable/c/de42f86e2cf5028a97e74c25869d1a962b13c301
https://git.kernel.org/stable/c/e76607442d5b73e1ba6768f501ef815bb58c2c0e
https://lore.kernel.org/linux-cve-announce/2026052712-CVE-2026-45842-71fc@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-45842
https://www.cve.org/CVERecord?id=CVE-2026-45842

History

Mon, 01 Jun 2026 17:00:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/3d71c961febddd855d3ae9a519eeb96c8023f430 https://git.kernel.org/stable/c/4aa9eca6fda2919027dfd7a7cc69334982d89586 https://git.kernel.org/stable/c/72304fec672e8aac9ee7b9c475db96b37cca8d8d

Thu, 28 May 2026 00:15:00 +0000

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2026052712-CVE-2026-45842-71fc@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-45842 https://www.cve.org/CVERecord?id=CVE-2026-45842
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Wed, 27 May 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476

Wed, 27 May 2026 10:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: slip: reject VJ receive packets on instances with no rstate array slhc_init() accepts rslots == 0 as a valid configuration, with the documented meaning of 'no receive compression'. In that case the allocation loop in slhc_init() is skipped, so comp->rstate stays NULL and comp->rslot_limit stays 0 (from the kzalloc of struct slcompress). The receive helpers do not defend against that configuration. slhc_uncompress() dereferences comp->rstate[x] when the VJ header carries an explicit connection ID, and slhc_remember() later assigns cs = &comp->rstate[...] after only comparing the packet's slot number to comp->rslot_limit. Because rslot_limit is 0, slot 0 passes the range check, and the code dereferences a NULL rstate. The configuration is reachable in-tree through PPP. PPPIOCSMAXCID stores its argument in a signed int, and (val >> 16) uses arithmetic shift. Passing 0xffff0000 therefore sign-extends to -1, so val2 + 1 is 0 and ppp_generic.c ends up calling slhc_init(0, 1). Because /dev/ppp open is gated by ns_capable(CAP_NET_ADMIN), the whole path is reachable from an unprivileged user namespace. Once the malformed VJ state is installed, any inbound VJ-compressed or VJ-uncompressed frame that selects slot 0 crashes the kernel in softirq context: Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:slhc_uncompress (drivers/net/slip/slhc.c:519) Call Trace: <TASK> ppp_receive_nonmp_frame (drivers/net/ppp/ppp_generic.c:2466) ppp_input (drivers/net/ppp/ppp_generic.c:2359) ppp_async_process (drivers/net/ppp/ppp_async.c:492) tasklet_action_common (kernel/softirq.c:926) handle_softirqs (kernel/softirq.c:623) run_ksoftirqd (kernel/softirq.c:1055) smpboot_thread_fn (kernel/smpboot.c:160) kthread (kernel/kthread.c:436) ret_from_fork (arch/x86/kernel/process.c:164) </TASK> Reject the receive side on such instances instead of touching rstate. slhc_uncompress() falls through to its existing 'bad' label, which bumps sls_i_error and enters the toss state. slhc_remember() mirrors that with an explicit sls_i_error increment followed by slhc_toss(); the sls_i_runt counter is not used here because a missing rstate is an internal configuration state, not a runt packet. The transmit path is unaffected: the only in-tree caller that picks rslots from userspace (ppp_generic.c) still supplies tslots >= 1, and slip.c always calls slhc_init(16, 16), so comp->tstate remains valid and slhc_compress() continues to work.
Title		slip: reject VJ receive packets on instances with no rstate array
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/7b0d9e878ec2b21d99ae8051b3dda59cdb66c152 https://git.kernel.org/stable/c/9e1ff0eead073c4f46d874ad2526b7dda5465faf https://git.kernel.org/stable/c/c6980e8b1a86288167f34966fa5219031999b6f1 https://git.kernel.org/stable/c/de42f86e2cf5028a97e74c25869d1a962b13c301 https://git.kernel.org/stable/c/e76607442d5b73e1ba6768f501ef815bb58c2c0e

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-05-27T09:24:42.637Z

Updated: 2026-06-14T17:46:17.557Z

Reserved: 2026-05-13T15:03:33.078Z

Link: CVE-2026-45842

Vulnrichment

No data.

NVD

Status : Awaiting Analysis

Published: 2026-05-27T11:16:23.600

Modified: 2026-06-01T17:17:14.320

Link: CVE-2026-45842

Redhat

Severity : Moderate

Publid Date: 2026-05-27T00:00:00Z

Links: CVE-2026-45842 - Bugzilla

OpenCVE Enrichment

Updated: 2026-05-28T02:15:04Z

Weaknesses

CWE-476
NULL Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object