CVE-2026-45842: Linux Kernel SLIP Driver DoS Vulnerability

CVE-2026-45842 Overview

CVE-2026-45842 is a Linux kernel vulnerability in the Serial Line Internet Protocol (SLIP) Van Jacobson (VJ) header compression code. The flaw allows an unprivileged user in a user namespace to trigger a NULL pointer dereference in softirq context, crashing the kernel. The issue affects slhc_uncompress() and slhc_remember() in drivers/net/slip/slhc.c, which fail to validate whether the receive state array (rstate) was allocated before dereferencing it. The vulnerability is reachable through the Point-to-Point Protocol (PPP) interface via the PPPIOCSMAXCID ioctl.

Critical Impact
Unprivileged local users can crash the Linux kernel by sending a crafted VJ-compressed frame through PPP after configuring zero receive slots, resulting in denial of service.

Affected Products

Linux kernel (mainline) — drivers/net/slip/slhc.c SLIP/VJ compression module
Linux distributions shipping affected kernels with PPP support enabled
Systems exposing /dev/ppp to user namespaces with CAP_NET_ADMIN

Discovery Timeline

2026-05-27 - CVE-2026-45842 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-45842

Vulnerability Analysis

The vulnerability resides in the SLIP Van Jacobson TCP/IP header compression implementation. slhc_init() accepts rslots == 0 as a valid configuration, documented as meaning no receive compression. When this configuration is used, the allocation loop is skipped, leaving comp->rstate set to NULL and comp->rslot_limit set to 0.

The receive helpers do not check for this state. slhc_uncompress() dereferences comp->rstate[x] when a VJ header carries an explicit connection ID. slhc_remember() assigns cs = &comp->rstate[...] after only comparing the packet slot number against comp->rslot_limit. Because rslot_limit is 0, a packet with slot 0 passes the range check and the code dereferences a NULL pointer.

The crash occurs in softirq context within the PPP receive path, causing a general protection fault flagged by KASAN as a null-ptr-deref.

Root Cause

The root cause is a missing validation between slhc_init() and the receive helpers. The transmit path enforces a valid tstate, but the receive path assumes rstate is allocated whenever the compressor instance exists. This is a [CWE-476] NULL Pointer Dereference combined with insufficient input validation on the PPPIOCSMAXCID ioctl parameter.

Attack Vector

The configuration is reachable in-tree through PPP. PPPIOCSMAXCID stores its argument in a signed int, and (val >> 16) uses arithmetic shift. Passing 0xffff0000 sign-extends to -1, so val2 + 1 evaluates to 0 and ppp_generic.c invokes slhc_init(0, 1). Because /dev/ppp open is gated by ns_capable(CAP_NET_ADMIN), the path is reachable from an unprivileged user namespace.

Once the malformed VJ state is installed, any inbound VJ-compressed or VJ-uncompressed frame that selects slot 0 crashes the kernel. The crash trace traverses ppp_async_process → ppp_input → ppp_receive_nonmp_frame → slhc_uncompress, terminating in a general protection fault.

No synthetic exploit code is published. Refer to the upstream commits for the precise patch logic.

Detection Methods for CVE-2026-45842

Indicators of Compromise

Kernel oops messages referencing slhc_uncompress or slhc_remember with a non-canonical address near 0xdffffc0000000000 on KASAN-enabled builds.
Unexpected kernel panics originating in ppp_async_process or ppp_receive_nonmp_frame softirq paths.
Increments in the sls_i_error counter on SLIP/PPP interfaces following inbound VJ traffic.

Detection Strategies

Audit processes invoking the PPPIOCSMAXCID ioctl on /dev/ppp with values where the upper 16 bits encode a negative integer.
Monitor for unprivileged processes within user namespaces holding CAP_NET_ADMIN and opening /dev/ppp.
Inspect kernel ring buffer logs for repeated general protection faults tied to PPP or SLIP modules.

Monitoring Recommendations

Enable kernel auditing for ioctl calls against /dev/ppp and correlate with namespace creation events.
Track kernel crash telemetry across fleet endpoints to surface clusters of PPP-related faults indicative of exploitation attempts.
Alert on user namespace creation by non-root processes on systems that do not require PPP functionality.

How to Mitigate CVE-2026-45842

Immediate Actions Required

Apply the upstream kernel patches referenced in the stable tree commits as soon as vendor builds are available.
Disable unprivileged user namespaces if PPP is not required, by setting kernel.unprivileged_userns_clone=0 or the equivalent sysctl on your distribution.
Unload the ppp_generic and slhc modules on systems that do not need PPP or SLIP networking.

Patch Information

The fix rejects the receive path when rstate is NULL. slhc_uncompress() falls through to the existing bad label, incrementing sls_i_error and entering the toss state. slhc_remember() mirrors this with an explicit sls_i_error increment followed by slhc_toss(). The transmit path is unaffected because in-tree callers always supply tslots >= 1. Patches are available in the following commits: Kernel Git Commit 7b0d9e8, Kernel Git Commit 9e1ff0e, Kernel Git Commit c6980e8, Kernel Git Commit de42f86, and Kernel Git Commit e766074.

Workarounds

Blacklist the slhc and ppp_generic kernel modules where PPP is not in operational use.
Restrict access to /dev/ppp using filesystem permissions and seccomp profiles for containerized workloads.
Disable VJ header compression on PPP links by configuring novj and novjccomp options in pppd.

bash

# Disable unprivileged user namespaces (requires kernel support)
sysctl -w kernel.unprivileged_userns_clone=0

# Prevent the vulnerable modules from loading
echo 'install slhc /bin/true' >> /etc/modprobe.d/cve-2026-45842.conf
echo 'install ppp_generic /bin/true' >> /etc/modprobe.d/cve-2026-45842.conf

# For active PPP deployments, disable VJ compression in pppd options
echo 'novj' >> /etc/ppp/options
echo 'novjccomp' >> /etc/ppp/options