CVE-2026-45842

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

slip: reject VJ receive packets on instances with no rstate array

slhc_init() accepts rslots == 0 as a valid configuration, with the

documented meaning of 'no receive compression'. In that case the

allocation loop in slhc_init() is skipped, so comp->rstate stays

NULL and comp->rslot_limit stays 0 (from the kzalloc of struct

slcompress).

The receive helpers do not defend against that configuration.

slhc_uncompress() dereferences comp->rstate[x] when the VJ header

carries an explicit connection ID, and slhc_remember() later assigns

cs = &comp->rstate[...] after only comparing the packet's slot number

to comp->rslot_limit. Because rslot_limit is 0, slot 0 passes the

range check, and the code dereferences a NULL rstate.

The configuration is reachable in-tree through PPP. PPPIOCSMAXCID

stores its argument in a signed int, and (val >> 16) uses arithmetic

shift. Passing 0xffff0000 therefore sign-extends to -1, so val2 + 1

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References