CVE-2026-45842
Description
In the Linux kernel, the following vulnerability has been resolved:
slip: reject VJ receive packets on instances with no rstate array
slhc_init() accepts rslots == 0 as a valid configuration, with the documented meaning of 'no receive compression'. In that case the allocation loop in slhc_init() is skipped, so comp->rstate stays NULL and comp->rslot_limit stays 0 (from the kzalloc of struct slcompress).
The receive helpers do not defend against that configuration. slhc_uncompress() dereferences comp->rstate[x] when the VJ header carries an explicit connection ID, and slhc_remember() later assigns cs = &comp->rstate[...] after only comparing the packet's slot number to comp->rslot_limit. Because rslot_limit is 0, slot 0 passes the range check, and the code dereferences a NULL rstate.
The configuration is reachable in-tree through PPP. PPPIOCSMAXCID stores its argument in a signed int, and (val >> 16) uses arithmetic shift. Passing 0xffff0000 therefore sign-extends to -1, so val2 + 1 is 0 and ppp_generic.c ends up calling slhc_init(0, 1). Because /dev/ppp open is gated by ns_capable(CAP_NET_ADMIN), the whole path is reachable from an unprivileged user namespace. Once the malformed VJ state is installed, any inbound VJ-compressed or VJ-uncompressed frame that selects slot 0 crashes the kernel in softirq context:
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:slhc_uncompress (drivers/net/slip/slhc.c:519) Call Trace:
ppp_receive_nonmp_frame (drivers/net/ppp/ppp_generic.c:2466) ppp_input (drivers/net/ppp/ppp_generic.c:2359) ppp_async_process (drivers/net/ppp/ppp_async.c:492) tasklet_action_common (kernel/softirq.c:926) handle_softirqs (kernel/softirq.c:623) run_ksoftirqd (kernel/softirq.c:1055) smpboot_thread_fn (kernel/smpboot.c:160) kthread (kernel/kthread.c:436) ret_from_fork (arch/x86/kernel/process.c:164)
Reject the receive side on such instances instead of touching rstate. slhc_uncompress() falls through to its existing 'bad' label, which bumps sls_i_error and enters the toss state. slhc_remember() mirrors that with an explicit sls_i_error increment followed by slhc_toss(); the sls_i_runt counter is not used here because a missing rstate is an internal configuration state, not a runt packet.
The transmit path is unaffected: the only in-tree caller that picks rslots from userspace (ppp_generic.c) still supplies tslots >= 1, and slip.c always calls slhc_init(16, 16), so comp->tstate remains valid and slhc_compress() continues to work.
Affected products
1Patches
10e76607442d5bslip: reject VJ receive packets on instances with no rstate array
1 file changed · +6 −1
drivers/net/slip/slhc.c+6 −1 modifieddiff --git a/drivers/net/slip/slhc.c b/drivers/net/slip/slhc.c index e3c785da3eef3d..e18a4213d10cec 100644 --- a/drivers/net/slip/slhc.c +++ b/drivers/net/slip/slhc.c @@ -506,6 +506,8 @@ slhc_uncompress(struct slcompress *comp, unsigned char *icp, int isize) comp->sls_i_error++; return 0; } + if (!comp->rstate) + goto bad; changes = *cp++; if(changes & NEW_C){ /* Make sure the state index is in range, then grab the state. @@ -649,6 +651,10 @@ slhc_remember(struct slcompress *comp, unsigned char *icp, int isize) struct cstate *cs; unsigned int ihl; + if (!comp->rstate) { + comp->sls_i_error++; + return slhc_toss(comp); + } /* The packet is shorter than a legal IP header. * Also make sure isize is positive. */ -- cgit 1.3-korg
7b0d9e878ec2slip: reject VJ receive packets on instances with no rstate array
1 file changed · +6 −1
drivers/net/slip/slhc.c+6 −1 modifieddiff --git a/drivers/net/slip/slhc.c b/drivers/net/slip/slhc.c index e3c785da3eef3d..e18a4213d10cec 100644 --- a/drivers/net/slip/slhc.c +++ b/drivers/net/slip/slhc.c @@ -506,6 +506,8 @@ slhc_uncompress(struct slcompress *comp, unsigned char *icp, int isize) comp->sls_i_error++; return 0; } + if (!comp->rstate) + goto bad; changes = *cp++; if(changes & NEW_C){ /* Make sure the state index is in range, then grab the state. @@ -649,6 +651,10 @@ slhc_remember(struct slcompress *comp, unsigned char *icp, int isize) struct cstate *cs; unsigned int ihl; + if (!comp->rstate) { + comp->sls_i_error++; + return slhc_toss(comp); + } /* The packet is shorter than a legal IP header. * Also make sure isize is positive. */ -- cgit 1.3-korg
de42f86e2cf5slip: reject VJ receive packets on instances with no rstate array
1 file changed · +6 −1
drivers/net/slip/slhc.c+6 −1 modifieddiff --git a/drivers/net/slip/slhc.c b/drivers/net/slip/slhc.c index ee9fd3a94b96fe..fcb3eebe7311c6 100644 --- a/drivers/net/slip/slhc.c +++ b/drivers/net/slip/slhc.c @@ -506,6 +506,8 @@ slhc_uncompress(struct slcompress *comp, unsigned char *icp, int isize) comp->sls_i_error++; return 0; } + if (!comp->rstate) + goto bad; changes = *cp++; if(changes & NEW_C){ /* Make sure the state index is in range, then grab the state. @@ -649,6 +651,10 @@ slhc_remember(struct slcompress *comp, unsigned char *icp, int isize) struct cstate *cs; unsigned int ihl; + if (!comp->rstate) { + comp->sls_i_error++; + return slhc_toss(comp); + } /* The packet is shorter than a legal IP header. * Also make sure isize is positive. */ -- cgit 1.3-korg
9e1ff0eead07slip: reject VJ receive packets on instances with no rstate array
1 file changed · +6 −1
drivers/net/slip/slhc.c+6 −1 modifieddiff --git a/drivers/net/slip/slhc.c b/drivers/net/slip/slhc.c index ee9fd3a94b96fe..fcb3eebe7311c6 100644 --- a/drivers/net/slip/slhc.c +++ b/drivers/net/slip/slhc.c @@ -506,6 +506,8 @@ slhc_uncompress(struct slcompress *comp, unsigned char *icp, int isize) comp->sls_i_error++; return 0; } + if (!comp->rstate) + goto bad; changes = *cp++; if(changes & NEW_C){ /* Make sure the state index is in range, then grab the state. @@ -649,6 +651,10 @@ slhc_remember(struct slcompress *comp, unsigned char *icp, int isize) struct cstate *cs; unsigned int ihl; + if (!comp->rstate) { + comp->sls_i_error++; + return slhc_toss(comp); + } /* The packet is shorter than a legal IP header. * Also make sure isize is positive. */ -- cgit 1.3-korg
c6980e8b1a86slip: reject VJ receive packets on instances with no rstate array
1 file changed · +6 −1
drivers/net/slip/slhc.c+6 −1 modifieddiff --git a/drivers/net/slip/slhc.c b/drivers/net/slip/slhc.c index bf9e801cc61cce..3474792a37a677 100644 --- a/drivers/net/slip/slhc.c +++ b/drivers/net/slip/slhc.c @@ -506,6 +506,8 @@ slhc_uncompress(struct slcompress *comp, unsigned char *icp, int isize) comp->sls_i_error++; return 0; } + if (!comp->rstate) + goto bad; changes = *cp++; if(changes & NEW_C){ /* Make sure the state index is in range, then grab the state. @@ -649,6 +651,10 @@ slhc_remember(struct slcompress *comp, unsigned char *icp, int isize) struct cstate *cs; unsigned int ihl; + if (!comp->rstate) { + comp->sls_i_error++; + return slhc_toss(comp); + } /* The packet is shorter than a legal IP header. * Also make sure isize is positive. */ -- cgit 1.3-korg
7b0d9e878ec2slip: reject VJ receive packets on instances with no rstate array
1 file changed · +6 −1
drivers/net/slip/slhc.c+6 −1 modifieddiff --git a/drivers/net/slip/slhc.c b/drivers/net/slip/slhc.c index e3c785da3eef3d..e18a4213d10cec 100644 --- a/drivers/net/slip/slhc.c +++ b/drivers/net/slip/slhc.c @@ -506,6 +506,8 @@ slhc_uncompress(struct slcompress *comp, unsigned char *icp, int isize) comp->sls_i_error++; return 0; } + if (!comp->rstate) + goto bad; changes = *cp++; if(changes & NEW_C){ /* Make sure the state index is in range, then grab the state. @@ -649,6 +651,10 @@ slhc_remember(struct slcompress *comp, unsigned char *icp, int isize) struct cstate *cs; unsigned int ihl; + if (!comp->rstate) { + comp->sls_i_error++; + return slhc_toss(comp); + } /* The packet is shorter than a legal IP header. * Also make sure isize is positive. */ -- cgit 1.3-korg
de42f86e2cf5slip: reject VJ receive packets on instances with no rstate array
1 file changed · +6 −1
drivers/net/slip/slhc.c+6 −1 modifieddiff --git a/drivers/net/slip/slhc.c b/drivers/net/slip/slhc.c index ee9fd3a94b96fe..fcb3eebe7311c6 100644 --- a/drivers/net/slip/slhc.c +++ b/drivers/net/slip/slhc.c @@ -506,6 +506,8 @@ slhc_uncompress(struct slcompress *comp, unsigned char *icp, int isize) comp->sls_i_error++; return 0; } + if (!comp->rstate) + goto bad; changes = *cp++; if(changes & NEW_C){ /* Make sure the state index is in range, then grab the state. @@ -649,6 +651,10 @@ slhc_remember(struct slcompress *comp, unsigned char *icp, int isize) struct cstate *cs; unsigned int ihl; + if (!comp->rstate) { + comp->sls_i_error++; + return slhc_toss(comp); + } /* The packet is shorter than a legal IP header. * Also make sure isize is positive. */ -- cgit 1.3-korg
9e1ff0eead07slip: reject VJ receive packets on instances with no rstate array
1 file changed · +6 −1
drivers/net/slip/slhc.c+6 −1 modifieddiff --git a/drivers/net/slip/slhc.c b/drivers/net/slip/slhc.c index ee9fd3a94b96fe..fcb3eebe7311c6 100644 --- a/drivers/net/slip/slhc.c +++ b/drivers/net/slip/slhc.c @@ -506,6 +506,8 @@ slhc_uncompress(struct slcompress *comp, unsigned char *icp, int isize) comp->sls_i_error++; return 0; } + if (!comp->rstate) + goto bad; changes = *cp++; if(changes & NEW_C){ /* Make sure the state index is in range, then grab the state. @@ -649,6 +651,10 @@ slhc_remember(struct slcompress *comp, unsigned char *icp, int isize) struct cstate *cs; unsigned int ihl; + if (!comp->rstate) { + comp->sls_i_error++; + return slhc_toss(comp); + } /* The packet is shorter than a legal IP header. * Also make sure isize is positive. */ -- cgit 1.3-korg
e76607442d5bslip: reject VJ receive packets on instances with no rstate array
1 file changed · +6 −1
drivers/net/slip/slhc.c+6 −1 modifieddiff --git a/drivers/net/slip/slhc.c b/drivers/net/slip/slhc.c index e3c785da3eef3d..e18a4213d10cec 100644 --- a/drivers/net/slip/slhc.c +++ b/drivers/net/slip/slhc.c @@ -506,6 +506,8 @@ slhc_uncompress(struct slcompress *comp, unsigned char *icp, int isize) comp->sls_i_error++; return 0; } + if (!comp->rstate) + goto bad; changes = *cp++; if(changes & NEW_C){ /* Make sure the state index is in range, then grab the state. @@ -649,6 +651,10 @@ slhc_remember(struct slcompress *comp, unsigned char *icp, int isize) struct cstate *cs; unsigned int ihl; + if (!comp->rstate) { + comp->sls_i_error++; + return slhc_toss(comp); + } /* The packet is shorter than a legal IP header. * Also make sure isize is positive. */ -- cgit 1.3-korg
c6980e8b1a86slip: reject VJ receive packets on instances with no rstate array
1 file changed · +6 −1
drivers/net/slip/slhc.c+6 −1 modifieddiff --git a/drivers/net/slip/slhc.c b/drivers/net/slip/slhc.c index bf9e801cc61cce..3474792a37a677 100644 --- a/drivers/net/slip/slhc.c +++ b/drivers/net/slip/slhc.c @@ -506,6 +506,8 @@ slhc_uncompress(struct slcompress *comp, unsigned char *icp, int isize) comp->sls_i_error++; return 0; } + if (!comp->rstate) + goto bad; changes = *cp++; if(changes & NEW_C){ /* Make sure the state index is in range, then grab the state. @@ -649,6 +651,10 @@ slhc_remember(struct slcompress *comp, unsigned char *icp, int isize) struct cstate *cs; unsigned int ihl; + if (!comp->rstate) { + comp->sls_i_error++; + return slhc_toss(comp); + } /* The packet is shorter than a legal IP header. * Also make sure isize is positive. */ -- cgit 1.3-korg
Vulnerability mechanics
Root cause
"Missing NULL-pointer check for comp->rstate in VJ-compression receive helpers when slhc_init() is called with rslots == 0."
Attack vector
An attacker with `CAP_NET_ADMIN` in an unprivileged user namespace can open `/dev/ppp` and issue `PPPIOCSMAXCID` with the value `0xffff0000`. Due to a signed-arithmetic-shift bug in `ppp_generic.c`, this causes `slhc_init(0, 1)` to be called, creating a VJ compression instance with `comp->rstate == NULL` and `comp->rslot_limit == 0`. Once this malformed state is installed, any inbound VJ-compressed or VJ-uncompressed PPP frame that selects slot 0 triggers a NULL-pointer dereference in `slhc_uncompress()` or `slhc_remember()`, crashing the kernel in softirq context. [patch_id=2654187]
Affected code
The vulnerability resides in `drivers/net/slip/slhc.c` in the functions `slhc_uncompress()` (line ~519) and `slhc_remember()` (line ~649). Both functions dereference `comp->rstate` without checking whether it is NULL, which occurs when `slhc_init()` is called with `rslots == 0` (meaning no receive compression). [patch_id=2654187]
What the fix does
The patch adds a NULL check for `comp->rstate` at the entry of both `slhc_uncompress()` and `slhc_remember()` in `drivers/net/slip/slhc.c`. In `slhc_uncompress()`, if `rstate` is NULL the function jumps to the existing `bad` label, which increments `sls_i_error` and enters the toss state. In `slhc_remember()`, the check increments `sls_i_error` and explicitly calls `slhc_toss()`. This prevents the NULL-pointer dereference that previously occurred when slot 0 passed the `rslot_limit` check (which was 0). [patch_id=2654187]
Preconditions
- authAttacker must have CAP_NET_ADMIN capability in a user namespace (ns_capable(CAP_NET_ADMIN) check on /dev/ppp open)
- networkAttacker must be able to send a VJ-compressed or VJ-uncompressed PPP frame that selects slot 0 to the affected interface
- inputThe PPPIOCSMAXCID ioctl must be issued with value 0xffff0000 to trigger slhc_init(0, 1)
Generated on May 27, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
5- git.kernel.org/stable/c/7b0d9e878ec2b21d99ae8051b3dda59cdb66c152nvd
- git.kernel.org/stable/c/9e1ff0eead073c4f46d874ad2526b7dda5465fafnvd
- git.kernel.org/stable/c/c6980e8b1a86288167f34966fa5219031999b6f1nvd
- git.kernel.org/stable/c/de42f86e2cf5028a97e74c25869d1a962b13c301nvd
- git.kernel.org/stable/c/e76607442d5b73e1ba6768f501ef815bb58c2c0envd
News mentions
0No linked articles in our index yet.