# CVE-2026-45842: slip: reject VJ receive packets on instances with no rstate array

Status: published. Published: 2026-05-27. Updated: 2026-11-06.

In the Linux kernel, the following vulnerability has been resolved:

slip: reject VJ receive packets on instances with no rstate array

slhc_init() accepts rslots == 0 as a valid configuration, with the
documented meaning of 'no receive compression'. In that case the
allocation loop in slhc_init() is skipped, so comp->rstate stays
NULL and comp->rslot_limit stays 0 (from the kzalloc of struct
slcompress).

The receive helpers do not defend against that configuration.
slhc_uncompress() dereferences comp->rstate[x] when the VJ header
carries an explicit connection ID, and slhc_remember() later assigns
cs = &comp->rstate[...] after only comparing the packet's slot number
to comp->rslot_limit. Because rslot_limit is 0, slot 0 passes the
range check, and the code dereferences a NULL rstate.

The configuration is reachable in-tree through PPP. PPPIOCSMAXCID
stores its argument in a signed int, and (val >> 16) uses arithmetic
shift. Passing 0xffff0000 therefore sign-extends to -1, so val2 + 1
is 0 and ppp_generic.c ends up calling slhc_init(0, 1). Because
/dev/ppp open is gated by ns_capable(CAP_NET_ADMIN), the whole path
is reachable from an unprivileged user namespace. Once the malformed
VJ state is installed, any inbound VJ-compressed or VJ-uncompressed
frame that selects slot 0 crashes the kernel in softirq context:

 Oops: general protection fault, probably for non-canonical
       address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI
 KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
 RIP: 0010:slhc_uncompress (drivers/net/slip/slhc.c:519)
 Call Trace:
  <TASK>
  ppp_receive_nonmp_frame (drivers/net/ppp/ppp_generic.c:2466)
  ppp_input (drivers/net/ppp/ppp_generic.c:2359)
  ppp_async_process (drivers/net/ppp/ppp_async.c:492)
  tasklet_action_common (kernel/softirq.c:926)
  handle_softirqs (kernel/softirq.c:623)
  run_ksoftirqd (kernel/softirq.c:1055)
  smpboot_thread_fn (kernel/smpboot.c:160)
  kthread (kernel/kthread.c:436)
  ret_from_fork (arch/x86/kernel/process.c:164)
  </TASK>

Reject the receive side on such instances instead of touching rstate.
slhc_uncompress() falls through to its existing 'bad' label, which
bumps sls_i_error and enters the toss state. slhc_remember() mirrors
that with an explicit sls_i_error increment followed by slhc_toss();
the sls_i_runt counter is not used here because a missing rstate is
an internal configuration state, not a runt packet.

The transmit path is unaffected: the only in-tree caller that picks
rslots from userspace (ppp_generic.c) still supplies tslots >= 1, and
slip.c always calls slhc_init(16, 16), so comp->tstate remains valid
and slhc_compress() continues to work.

## Remediation

No remediation reported in collected sources

## Affected products and versions

- Linux / Linux: ≥ 4ab42d78e37a294ac7bc56901d563c642e03c4ae; < 3d71c961febddd855d3ae9a519eeb96c8023f430 (affected, git); ≥ 4ab42d78e37a294ac7bc56901d563c642e03c4ae; < 72304fec672e8aac9ee7b9c475db96b37cca8d8d (affected, git); ≥ 4ab42d78e37a294ac7bc56901d563c642e03c4ae; < 4aa9eca6fda2919027dfd7a7cc69334982d89586 (affected, git); ≥ 4ab42d78e37a294ac7bc56901d563c642e03c4ae; < c6980e8b1a86288167f34966fa5219031999b6f1 (affected, git); ≥ 4ab42d78e37a294ac7bc56901d563c642e03c4ae; < de42f86e2cf5028a97e74c25869d1a962b13c301 (affected, git); ≥ 4ab42d78e37a294ac7bc56901d563c642e03c4ae; < 9e1ff0eead073c4f46d874ad2526b7dda5465faf (affected, git); ≥ 4ab42d78e37a294ac7bc56901d563c642e03c4ae; < 7b0d9e878ec2b21d99ae8051b3dda59cdb66c152 (affected, git); ≥ 4ab42d78e37a294ac7bc56901d563c642e03c4ae; < e76607442d5b73e1ba6768f501ef815bb58c2c0e (affected, git); 42fc512469e78939c1e419d3310c47de55bdcbb8 (affected, git); df085f1cb3acd3d75408ff94f366983873bce7d2 (affected, git); a1c3860d3c5fc62bd35f089bcb03f18a37242de9 (affected, git); f82699de104eaf8a7ffc2849a566a94818dd8a3c (affected, git); 354b254af5c1350de9586af75fe5a821b35bfb33 (affected, git); 5148857f5d4c812cc918cf4627f7880521e987eb (affected, git); 82185755d90c8047c6f4b589c39998ff3d4ca3ad (affected, git); a50a93cc99286dc444c7e5ccc7dfb9d58c2d346d (affected, git); 6b4fa561e26526c62636414d267342c945084f44 (affected, git); ≥ 2.6.32.70; < 2.6.33 (affected, semver); ≥ 3.2.75; < 3.3 (affected, semver); ≥ 3.4.111; < 3.5 (affected, semver); ≥ 3.10.96; < 3.11 (affected, semver); ≥ 3.12.53; < 3.13 (affected, semver); ≥ 3.14.60; < 3.15 (affected, semver); ≥ 3.18.27; < 3.19 (affected, semver); ≥ 4.1.17; < 4.2 (affected, semver); ≥ 4.3.5; < 4.4 (affected, semver). Source: CNA: Linux
- Linux / Linux: 4.4 (affected); ≥ 0; < 4.4 (unaffected, semver); ≥ 5.10.258; ≤ 5.10.* (unaffected, semver); ≥ 5.15.209; ≤ 5.15.* (unaffected, semver); ≥ 6.1.175; ≤ 6.1.* (unaffected, semver); ≥ 6.6.141; ≤ 6.6.* (unaffected, semver); ≥ 6.12.91; ≤ 6.12.* (unaffected, semver); ≥ 6.18.33; ≤ 6.18.* (unaffected, semver); ≥ 7.0.10; ≤ 7.0.* (unaffected, semver); ≥ 7.1; ≤ * (unaffected, original_commit_for_fix). Source: CNA: Linux
- Siemens / SIMATIC S7-1500 TM MFP - GNU/Linux subsystem: ≥ 0; < * (affected, custom). Source: ADP: siemens-SADP

## Severity and prioritization

- CISA KEV: No listing in collected sources

- EPSS: 0.13% as of 2026-11-06; percentile 2.61%

- SSVC: exploitation none; automatable no; technical impact partial; source ADP: CISA-ADP

- Weaknesses: Not reported

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://git.kernel.org/stable/c/3d71c961febddd855d3ae9a519eeb96c8023f430 (CNA: Linux)

- https://git.kernel.org/stable/c/72304fec672e8aac9ee7b9c475db96b37cca8d8d (CNA: Linux)

- https://git.kernel.org/stable/c/4aa9eca6fda2919027dfd7a7cc69334982d89586 (CNA: Linux)

- https://git.kernel.org/stable/c/c6980e8b1a86288167f34966fa5219031999b6f1 (CNA: Linux)

- https://git.kernel.org/stable/c/de42f86e2cf5028a97e74c25869d1a962b13c301 (CNA: Linux)

- https://git.kernel.org/stable/c/9e1ff0eead073c4f46d874ad2526b7dda5465faf (CNA: Linux)

- https://git.kernel.org/stable/c/7b0d9e878ec2b21d99ae8051b3dda59cdb66c152 (CNA: Linux)

- https://git.kernel.org/stable/c/e76607442d5b73e1ba6768f501ef815bb58c2c0e (CNA: Linux)

- https://cert-portal.siemens.com/productcert/html/ssa-784472.html (ADP: siemens-SADP)

## Provenance

- CNA: Linux: https://www.cve.org/CVERecord?id=CVE-2026-45842; retrieved 2026-11-06; source updated 2026-11-06

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2026-45842; retrieved 2026-11-06; source updated Not reported

Revision: 57bbee30e001774dbe04a9f8501e25da639cc0101eda8424dea73321d93c33d5

Canonical: https://y2.dev/cve/CVE-2026-45842

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.