Junglewise Threat Intelligence

CVE-2026-45842: Linux kernel NULL pointer dereference in SLIP VJ compression

CVE-2026-45842 · Severity: info · CVSS 6.2 · Published 2026-05-27

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's SLIP (Serial Line IP) and PPP (Point-to-Point Protocol) drivers could allow an attacker to crash the system. These components are responsible for managing network connections over serial lines or similar interfaces. By sending specially crafted network configuration commands, an unprivileged user can trigger a kernel crash, leading to a complete service outage (Denial of Service).

Technical details

A NULL pointer dereference exists in the Van Jacobson (VJ) compression implementation within the Linux kernel's SLIP driver (drivers/net/slip/slhc.c). The function slhc_init() allows a configuration where rslots is 0, which results in the rstate array remaining NULL. However, the receive path helpers slhc_uncompress() and slhc_remember() do not verify if rstate is NULL before dereferencing it. An attacker can reach this state via the PPP IOCTL PPPIOCSMAXCID by passing a value that sign-extends to -1, causing slhc_init(0, 1) to be called. This path is reachable from an unprivileged user namespace with CAP_NET_ADMIN. Once configured, any inbound VJ-compressed frame targeting slot 0 triggers a general protection fault in softirq context, crashing the kernel. Fixes have been backported to various stable branches.

Affected products

  • Linux Linux kernel All versions prior to the May 2026 patches

Timeline

  • 2026-04-16: other: Patch authored by Weiming Shi
  • 2026-05-23: patched: Commits applied to stable trees by Greg Kroah-Hartman
  • 2026-05-27: advisory: CVE-2026-45842 published

References