PT-2026-43676 · Linux · Linux Kernel

Published 2026-05-27 · Updated 2026-05-27 · CVE-2026-45842

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A flaw exists in the SLIP (Serial Line IP) implementation where the slhc init() function allows a configuration with rslots set to 0, indicating no receive compression. In this state, the comp->rstate pointer remains NULL and comp->rslot limit is 0. The receive helpers slhc uncompress() and slhc remember() fail to validate this configuration, leading to a NULL pointer dereference when processing VJ-compressed or uncompressed frames that select slot 0. This can be triggered via PPP by passing a specific value to PPPIOCSMAXCID, which is reachable from an unprivileged user namespace due to the way /dev/ppp is gated. Successful exploitation results in a kernel crash in softirq context.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2026-45842

Affected Products

Linux Kernel

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2026-45842 · Security Note
• https://git.kernel.org/stable/c/7b0d9e878ec2b21d99ae8051b3dda59cdb66c152 · Note
• https://t.me/CVEtracker/55116 · Telegram Post
• https://git.kernel.org/stable/c/9e1ff0eead073c4f46d874ad2526b7dda5465faf · Note
• https://git.kernel.org/stable/c/72304fec672e8aac9ee7b9c475db96b37cca8d8d · Note
• https://git.kernel.org/stable/c/c6980e8b1a86288167f34966fa5219031999b6f1 · Note
• https://twitter.com/VulmonFeeds/status/2059677670972023081 · Twitter Post
• https://git.kernel.org/stable/c/3d71c961febddd855d3ae9a519eeb96c8023f430 · Note
• https://git.kernel.org/stable/c/de42f86e2cf5028a97e74c25869d1a962b13c301 · Note
• https://git.kernel.org/stable/c/e76607442d5b73e1ba6768f501ef815bb58c2c0e · Note
• https://git.kernel.org/stable/c/4aa9eca6fda2919027dfd7a7cc69334982d89586 · Note