The Linux kernel’s SLIP implementation contains an out‑of‑bounds read in the slhc_uncompress() path, which parses VJ‑compressed TCP headers. During parsing, the helper functions decode() and pull16() advance a pointer through packet payload without verifying that the pointer stays within the compressed packet length. When a short compressed frame requests optional fields, decode() reads past the end of the buffer; the over‑read bytes are incorporated into the compressor state and subsequently reflected into later reconstructed packets. This results in kernel data being leaked through normal packet processing and constitutes an Information Disclosure vulnerability (CWE‑125 and CWE‑126).

All Linux kernel releases that include SLIP support and the VJ TCP header compression algorithm are affected. The affected versions explicitly listed are Linux kernel 2.6.12 and its release candidates (rc2 through rc5). Any system running a kernel that contains the slhc_uncompress() code path and accepts SLIP traffic is at risk.

The flaw can be triggered by an adversary who can supply crafted SLIP/VJ packets to the target host. Because the over‑read is silent and not signalled to the caller, the exploitation phase is passive: leaked bytes are later broadcast in reconstructed traffic. The CVSS vector of 8.2 reflects the high impact of potential data exposure, while the EPSS score of less than 1% indicates the exploitation probability is low. The vulnerability is not listed in the CISA KEV catalog, suggesting no widespread active exploitation has been documented. Despite the low EPSS, presence of the vulnerability in core kernel code warrants prompt action to avoid accidental or targeted data leakage.