CVE-2026-45843

A flaw was found in the Linux kernel's Serial Line Internet Protocol (SLIP) implementation. The slhc_uncompress() function, which handles VJ-compressed TCP headers, fails to perform proper bounds checks during packet processing. A remote attacker could exploit this by sending a specially crafted compressed frame, causing an out-of-bounds read. This vulnerability may lead to information disclosure or data corruption in subsequent reconstructed packets.

SLIP VJ header decompression in slhc_uncompress can read beyond the compressed frame because decode and pull16 advanced through optional fields without checking the packet end. A short compressed frame can make overread bytes influence cached cstate and later reconstructed TCP/IP packets, so an adjacent SLIP peer may cause limited information exposure or packet/header corruption. For the CVSS the PR:N is used for the paranoid score because a peer on an already configured SLIP/VJ link can send crafted compressed frames without privileges on the victim. The issue is not Internet remote and depends on SLIP with VJ compression, which is uncommon. Impact is mainly limited confidentiality and integrity impact plus possible connection disruption, with no evidence of kernel memory write or privilege escalation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.