CVE-2026-45842
published 2026-05-27CVE-2026-45842: In the Linux kernel, the following vulnerability has been resolved: slip: reject VJ receive packets on instances with no rstate array slhc_init() accepts…
medium5.5
In the Linux kernel, the following vulnerability has been resolved:
slip: reject VJ receive packets on instances with no rstate array
slhc_init() accepts rslots == 0 as a valid configuration, with the
documented meaning of 'no receive compression'. In that case the
allocation loop in slhc_init() is skipped, so comp->rstate stays
NULL and comp->rslot_limit stays 0 (from the kzalloc of struct
slcompress).
The receive helpers do not defend against that configuration.
slhc_uncompress() dereferences comp->rstate[x] when the VJ header
carries an explicit connection ID, and slhc_remember() later assigns
cs = &comp->rstate[...] after only comparing the packet's slot number
to comp->rslot_limit. Because rslot_limit is 0, slot 0 passes the
range check, and the code dereferences a NULL rstate.
The configuration is reachable in-tree through PPP. PPPIOCSMAXCID
stores its argument in a signed int, and (val >> 16) uses arithmetic
shift. Passing 0xffff0000 therefore sign-extends to -1, so val2 + 1
is 0 and ppp_generic.c ends up calling slhc_init(0, 1). Because
/dev/ppp open is gated by ns_capable(CAP_NET_ADMIN), the whole path
is reachable from an unprivileged user namespace. Once the malformed
VJ state is installed, any inbound VJ-compressed or VJ-uncompressed
frame that selects slot 0 crashes the kernel in softirq context:
Oops: general protection fault, probably for non-canonical
address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
RIP: 0010:slhc_uncompress (drivers/net/slip/slhc.c:519)
Call Trace:
ppp_receive_nonmp_frame (drivers/net/ppp/ppp_generic.c:2466)
ppp_input (drivers/net/ppp/ppp_generic.c:2359)
ppp_async_process (drivers/net/ppp/ppp_async.c:492)
tasklet_action_common (kernel/softirq.c:926)
handle_softirqs (kernel/softirq.c:623)
run_ksoftirqd (kernel/softirq.c:1055)
smpboot_thread_fn (kernel/smpboot.c:160)
kthread (kernel/kthread.c:436)
ret_from_fork (arch/x86/kernel/process.c:164)
Reject th
Affected
28 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | >= 2.6.32.70 < 2.6.33 | 2.6.33 |
| linux | linux | >= 3.10.96 < 3.11 | 3.11 |
| linux | linux | >= 3.12.53 < 3.13 | 3.13 |
| linux | linux | >= 3.14.60 < 3.15 | 3.15 |
| linux | linux | >= 3.18.27 < 3.19 | 3.19 |
| linux | linux | >= 3.2.75 < 3.3 | 3.3 |
| linux | linux | >= 3.4.111 < 3.5 | 3.5 |
| linux | linux | >= 4.1.17 < 4.2 | 4.2 |
| linux | linux | >= 4.3.5 < 4.4 | 4.4 |
| linux | linux | >= 4ab42d78e37a294ac7bc56901d563c642e03c4ae < 3d71c961febddd855d3ae9a519eeb96c8023f430 | 3d71c961febddd855d3ae9a519eeb96c8023f430 |
| linux | linux | >= 4ab42d78e37a294ac7bc56901d563c642e03c4ae < 72304fec672e8aac9ee7b9c475db96b37cca8d8d | 72304fec672e8aac9ee7b9c475db96b37cca8d8d |
| linux | linux | >= 4ab42d78e37a294ac7bc56901d563c642e03c4ae < 4aa9eca6fda2919027dfd7a7cc69334982d89586 | 4aa9eca6fda2919027dfd7a7cc69334982d89586 |
| linux | linux | >= 4ab42d78e37a294ac7bc56901d563c642e03c4ae < c6980e8b1a86288167f34966fa5219031999b6f1 | c6980e8b1a86288167f34966fa5219031999b6f1 |
| linux | linux | >= 4ab42d78e37a294ac7bc56901d563c642e03c4ae < de42f86e2cf5028a97e74c25869d1a962b13c301 | de42f86e2cf5028a97e74c25869d1a962b13c301 |
| linux | linux | >= 4ab42d78e37a294ac7bc56901d563c642e03c4ae < 9e1ff0eead073c4f46d874ad2526b7dda5465faf | 9e1ff0eead073c4f46d874ad2526b7dda5465faf |