The vulnerability arises when the Linux kernel parses a VJ compressed TCP header without verifying the packet length. The helper functions decode() and pull16() advance a pointer beyond the end of the packet, causing an out‑of‑bounds read. Because the read values are merged into the compressor state, subsequent packets may expose data that was not intended to be visible. The lack of an error flag means the over‑read is not detected, leaving the flaw hidden until affected data flows into the state cache.

All Linux kernel installations that support the SLIP protocol and use the VJ header compression algorithm are potentially impacted. No specific kernel release is listed, but the issue exists until the patch that adds bounds checking and error handling is applied to the slhc_uncompress() path.

This flaw can be triggered by a crafted compressed packet sent to a host over a network path that processes SLIP/VJ traffic. An attacker could remotely supply malicious frames to coerce kernel read beyond the packet boundary. The read could leak internal kernel data and, if combined with additional weaknesses, could lead to denial of service or privilege escalation. The exact CVSS score is not provided, but the EPSS is not available and the vulnerability is not yet in the KEV catalog, indicating limited publicly known exploitation, yet the nature of the flaw warrants immediate patching.