CVE-2026-45843: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-45843 Overview

CVE-2026-45843 is an out-of-bounds read vulnerability in the Linux kernel's Serial Line Internet Protocol (SLIP) implementation. The flaw resides in slhc_uncompress(), which decodes Van Jacobson (VJ) compressed TCP headers. The helper functions decode() and pull16() advance a pointer through the packet without bounds-checking against the input size isize. A short compressed frame whose change byte requests optional fields causes decode() to read past the end of the packet. The over-read bytes are folded into the cached cstate and reflected into subsequent reconstructed packets, leaking adjacent kernel memory into network traffic.

Critical Impact
An attacker delivering a malformed VJ-compressed SLIP frame can trigger kernel memory disclosure through reconstructed packets, exposing sensitive data to local or remote observers.

Affected Products

Linux kernel SLIP driver (drivers/net/slip) and the VJ header-compression code in slhc_uncompress()
Kernel branches addressed by commits 0511ecb, 37537e4, 4c1367a, 4cefe32, and d42bec6
Systems with the SLIP/CSLIP networking interface enabled or attached via PPP-VJ compression paths

Discovery Timeline

2026-05-27 - CVE-2026-45843 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-45843

Vulnerability Analysis

The defect lies in slhc_uncompress() within the kernel's VJ TCP header decompression logic. The function parses a compressed header by sequentially advancing a pointer using two helpers: decode(), which reads a variable-length integer, and pull16(), which reads a 16-bit value. Neither helper validates the cursor against the packet end pointer derived from isize, the compressed packet length.

A second defect compounds the issue. The decode() helper masks its return value with & 0xffff, so it can never produce the sentinel -1 value that callers use to detect failure. The existing == -1 error checks are unreachable, leaving the decode path without functional bounds validation.

When a crafted short frame sets change-byte flags requesting optional fields, the decoder continues reading past the buffer. Those out-of-bounds bytes are merged into the connection's cached compression state (cstate) and emitted in the reconstructed TCP/IP headers of subsequent packets on the same SLIP link.

Root Cause

The root cause is missing bounds enforcement in decode() and pull16() combined with a return-value mask that disables the only error signal callers test for. This is an Out-of-Bounds Read [CWE-125] in kernel networking code.

Attack Vector

An attacker who can deliver SLIP frames to the victim host, either by sitting on the serial/PPP link or by sourcing traffic carried over a tunnel that feeds the VJ decompressor, can submit a truncated compressed header whose change byte requests optional fields. The decompressor reads beyond the frame, captures uninitialized or adjacent memory contents, and reflects them into reconstructed packets that may be transmitted on the wire.

No verified public exploit code is available for CVE-2026-45843. Technical details are documented in the upstream fix commits, including Kernel Git Commit 0511ecb, 37537e4, 4c1367a, 4cefe32, and d42bec6.

Detection Methods for CVE-2026-45843

Indicators of Compromise

Anomalous bytes appearing in TCP/IP header fields of packets emerging from a SLIP or PPP-VJ interface, particularly in fields not set by the originating host.
Unexpected SLIP traffic on systems that do not normally use serial-line networking, indicating an attempt to reach the vulnerable code path.
Kernel logs referencing the slip or slhc modules around the time of suspicious network activity.

Detection Strategies

Inventory hosts with the slip and slhc kernel modules loaded using lsmod | grep -E 'slip|slhc' and flag any system where these modules are unexpectedly resident.
Monitor for kernel version drift across the fleet and identify hosts running kernels prior to the commits listed in the upstream advisory.
Inspect packet captures from SLIP/PPP endpoints for malformed VJ-compressed headers that request optional fields with insufficient payload length.

Monitoring Recommendations

Alert on kernel module loads for slip.ko and slhc.ko on production systems where serial networking is not a sanctioned function.
Track outbound traffic from SLIP interfaces for entropy anomalies in header bytes, which can indicate memory disclosure.
Centralize kernel and module-load telemetry into a SIEM and correlate against the published patched kernel versions.

How to Mitigate CVE-2026-45843

Immediate Actions Required

Apply the upstream Linux kernel patches referenced by commits 0511ecb, 37537e4, 4c1367a, 4cefe32, and d42bec6 once provided by your distribution vendor.
Disable and blacklist the slip and slhc kernel modules on systems that do not require serial-line networking.
Audit PPP configurations and disable VJ TCP/IP header compression where it is not strictly necessary.

Patch Information

The fix modifies decode() and pull16() to take the packet end pointer and return -1 when the cursor would advance past the buffer. A bounds check is added before the TCP-checksum read. The pre-existing == -1 error tests now function as originally intended. The patch is available across stable kernel branches via the commits listed in the kernel.org stable tree.

Workarounds

Blacklist the affected modules by adding blacklist slip and blacklist slhc to /etc/modprobe.d/ configuration, then rebuild the initramfs.
Disable VJ compression in PPP peer configurations with the novj and novjccomp options to prevent the vulnerable decompression path from executing.
Restrict physical and logical access to serial interfaces and tunnels that feed SLIP traffic into the kernel.

bash

# Configuration example: blacklist SLIP/CSLIP modules
echo 'blacklist slip'  | sudo tee /etc/modprobe.d/disable-slip.conf
echo 'blacklist slhc'  | sudo tee -a /etc/modprobe.d/disable-slip.conf
sudo update-initramfs -u

# Disable VJ compression in pppd
echo 'novj' | sudo tee -a /etc/ppp/options
echo 'novjccomp' | sudo tee -a /etc/ppp/options