CVE-2026-45843 slip: bound decode() reads against the compressed packet length
A missing bounds check in the Linux kernel's SLIP driver allows attackers to read memory beyond packet boundaries, potentially disclosing sensitive kernel data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-45843?
CVE-2026-45843 is a high-severity vulnerability in Linux kernel, published on 27 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
slip: bound decode() reads against the compressed packet length
slhc_uncompress() parses a VJ-compressed TCP header by advancing a pointer through the packet via decode() and pull16(). Neither helper bounds-checks against isize, and decode() masks its return with & 0xffff so it can never return the -1 that callers test for -- those error paths are dead code.
A short compressed frame whose change byte requests optional fields lets decode() read past the end of the packet. The over-read bytes are folded into the cached cstate and reflected into subsequent reconstructed packets.
Make decode() and pull16() take the packet end pointer and return -1 when exhausted. Add a bounds check before the TCP-checksum read. The existing == -1 tests now do what they were always meant to.
Weakness: CWE-126
Which versions are affected by CVE-2026-45843?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-45843?
Apply the vendor's patch.
Is CVE-2026-45843 being exploited?
There is no known exploitation of CVE-2026-45843 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-88553, BELL-CVE-2026-45843, DEBIAN-CVE-2026-45843, GHSA-58qm-9wwf-x958, ROOT-OS-DEBIAN-11-CVE-2026-45843, ROOT-OS-DEBIAN-12-CVE-2026-45843 and 4 more.