CVE-2026-45842

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> slip: reject VJ receive packets on instances with no rstate array<br /> <br /> slhc_init() accepts rslots == 0 as a valid configuration, with the<br /> documented meaning of &amp;#39;no receive compression&amp;#39;. In that case the<br /> allocation loop in slhc_init() is skipped, so comp-&gt;rstate stays<br /> NULL and comp-&gt;rslot_limit stays 0 (from the kzalloc of struct<br /> slcompress).<br /> <br /> The receive helpers do not defend against that configuration.<br /> slhc_uncompress() dereferences comp-&gt;rstate[x] when the VJ header<br /> carries an explicit connection ID, and slhc_remember() later assigns<br /> cs = &amp;comp-&gt;rstate[...] after only comparing the packet&amp;#39;s slot number<br /> to comp-&gt;rslot_limit. Because rslot_limit is 0, slot 0 passes the<br /> range check, and the code dereferences a NULL rstate.<br /> <br /> The configuration is reachable in-tree through PPP. PPPIOCSMAXCID<br /> stores its argument in a signed int, and (val &gt;&gt; 16) uses arithmetic<br /> shift. Passing 0xffff0000 therefore sign-extends to -1, so val2 + 1<br /> is 0 and ppp_generic.c ends up calling slhc_init(0, 1). Because<br /> /dev/ppp open is gated by ns_capable(CAP_NET_ADMIN), the whole path<br /> is reachable from an unprivileged user namespace. Once the malformed<br /> VJ state is installed, any inbound VJ-compressed or VJ-uncompressed<br /> frame that selects slot 0 crashes the kernel in softirq context:<br /> <br /> Oops: general protection fault, probably for non-canonical<br /> address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI<br /> KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]<br /> RIP: 0010:slhc_uncompress (drivers/net/slip/slhc.c:519)<br /> Call Trace:<br /> <br /> ppp_receive_nonmp_frame (drivers/net/ppp/ppp_generic.c:2466)<br /> ppp_input (drivers/net/ppp/ppp_generic.c:2359)<br /> ppp_async_process (drivers/net/ppp/ppp_async.c:492)<br /> tasklet_action_common (kernel/softirq.c:926)<br /> handle_softirqs (kernel/softirq.c:623)<br /> run_ksoftirqd (kernel/softirq.c:1055)<br /> smpboot_thread_fn (kernel/smpboot.c:160)<br /> kthread (kernel/kthread.c:436)<br /> ret_from_fork (arch/x86/kernel/process.c:164)<br /> <br /> <br /> Reject the receive side on such instances instead of touching rstate.<br /> slhc_uncompress() falls through to its existing &amp;#39;bad&amp;#39; label, which<br /> bumps sls_i_error and enters the toss state. slhc_remember() mirrors<br /> that with an explicit sls_i_error increment followed by slhc_toss();<br /> the sls_i_runt counter is not used here because a missing rstate is<br /> an internal configuration state, not a runt packet.<br /> <br /> The transmit path is unaffected: the only in-tree caller that picks<br /> rslots from userspace (ppp_generic.c) still supplies tslots &gt;= 1, and<br /> slip.c always calls slhc_init(16, 16), so comp-&gt;tstate remains valid<br /> and slhc_compress() continues to work.