Executive brief
A vulnerability was identified in the Linux kernel's SLIP (Serial Line IP) driver, which handles network data over serial connections. An attacker could send a specially crafted compressed network packet that causes the system to read data beyond the intended memory buffer. This could lead to the corruption of network connection states and potentially allow an attacker to influence or observe subsequent network traffic handled by the affected driver.
Technical details
A vulnerability exists in the slhc_uncompress() function within drivers/net/slip/slhc.c of the Linux kernel. The decode() and pull16() helper functions, used to parse Van Jacobson (VJ) compressed TCP headers, lacked proper bounds checking against the actual packet length (isize). Furthermore, decode() incorrectly masked its return value, rendering existing error-handling code unreachable. An attacker can exploit this by sending a short compressed frame with a 'change byte' that requests optional fields, forcing the kernel to read past the end of the allocated packet buffer. These over-read bytes are then folded into the cached connection state (cstate), which can corrupt subsequent reconstructed packets. The fix introduces explicit bounds checks and ensures error codes are correctly propagated.
Affected products
- Linux Linux Kernel Introduced in 2.6.12-rc2; fixed in various stable branches including 6.x and 5.x
Timeline
- 2026-04-16: other: Patch submitted by developer
- 2026-05-23: patched: Patch committed to stable trees
- 2026-05-27: advisory: CVE published in NVD
References
- https://git.kernel.org/stable/c/0511ecb00e61bf28e2fec4bb41fcce385c3a3b2d
- https://git.kernel.org/stable/c/37537e42e6df387398bee85cb85070cc80bb1e10
- https://git.kernel.org/stable/c/4c1367a2d7aad643a6f87c6931b13cc1a25e8ca7
- https://git.kernel.org/stable/c/4cefe32639933d652614b0bd50f818f9af4af78f
- https://git.kernel.org/stable/c/d42bec6e4f6d6d658be365539400b3314b76b2a7