The vulnerability arises when the Linux kernel parses a VJ compressed TCP header without verifying the packet length. The helper functions decode() and pull16() advance a pointer beyond the end of the packet, causing an out‑of‑bounds read. Because the read values are merged into the compressor state, subsequent packets may expose data that was not intended to be visible. The lack of an error flag means the over‑read is not detected, leaving the flaw hidden until affected data flows into the state cache.

All Linux kernel installations that support the SLIP protocol and use the VJ header compression algorithm are potentially impacted. No specific kernel release is listed, but the issue exists until the patch that adds bounds checking and error handling is applied to the slhc_uncompress() path.

The flaw can be triggered by a crafted compressed packet sent to a host over a network path that processes SLIP/VJ traffic. The likely attack vector is to deliver such a packet to the kernel, driving decode() to read beyond the packet boundary. Based on the description, it is inferred that the resulting over‑read bytes become part of the cached state, which may expose internal data. The CVSS score of 8.2 reflects high risk, and the EPSS score of <1% indicates a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting that known exploitation is limited.