Answer in brief
CVE-2026-45843 records a High severity (CVSS 8.2) vulnerability in slip: bound decode() reads against the compressed packet length. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
Answer in brief
CVE-2026-45843 records a High severity (CVSS 8.2) vulnerability in slip: bound decode() reads against the compressed packet length. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 8.2. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <6268f01ae989013671b526c883e92655342c6f6f || >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <9aafba2f49e1fcccc2018816f5836a609c925879 || >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <335957df4ed60f02a2ec0432fbedbf0cc7241d8b || >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <37537e42e6df387398bee85cb85070cc80bb1e10 || >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <4cefe32639933d652614b0bd50f818f9af4af78f || >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <0511ecb00e61bf28e2fec4bb41fcce385c3a3b2d || >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <d42bec6e4f6d6d658be365539400b3314b76b2a7 || >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <4c1367a2d7aad643a6f87c6931b13cc1a25e8ca7 | 6268f01ae989013671b526c883e92655342c6f6f, 9aafba2f49e1fcccc2018816f5836a609c925879, 335957df4ed60f02a2ec0432fbedbf0cc7241d8b, 37537e42e6df387398bee85cb85070cc80bb1e10, 4cefe32639933d652614b0bd50f818f9af4af78f, 0511ecb00e61bf28e2fec4bb41fcce385c3a3b2d, d42bec6e4f6d6d658be365539400b3314b76b2a7, 4c1367a2d7aad643a6f87c6931b13cc1a25e8ca7 |
| Linux/Linuxgeneric | 2.6.12 | Not reported |
Published upstream
May 27, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jun 26, 2026
In the Linux kernel, the following vulnerability has been resolved: slip: bound decode() reads against the compressed packet length slhc_uncompress() parses a VJ-compressed TCP header by advancing a pointer through the packet via decode() and pull16(). Neither helper bounds-checks against isize, and decode() masks its return with & 0xffff so it can never return the -1 that callers test for -- those error paths are dead code. A short compressed frame whose change byte requests optional fields lets decode() read past the end of the packet. The over-read bytes are folded into the cached cstate and reflected into subsequent reconstructed packets. Make decode() and pull16() take the packet end pointer and return -1 when exhausted. Add a bounds check before the TCP-checksum read. The existing == -1 tests now do what they were always meant to.
Quoted source text, attributed separately from HOL analysis.
CVSS is 8.2. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <6268f01ae989013671b526c883e92655342c6f6f || >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <9aafba2f49e1fcccc2018816f5836a609c925879 || >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <335957df4ed60f02a2ec0432fbedbf0cc7241d8b || >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <37537e42e6df387398bee85cb85070cc80bb1e10 || >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <4cefe32639933d652614b0bd50f818f9af4af78f || >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <0511ecb00e61bf28e2fec4bb41fcce385c3a3b2d || >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <d42bec6e4f6d6d658be365539400b3314b76b2a7 || >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <4c1367a2d7aad643a6f87c6931b13cc1a25e8ca7 | 6268f01ae989013671b526c883e92655342c6f6f, 9aafba2f49e1fcccc2018816f5836a609c925879, 335957df4ed60f02a2ec0432fbedbf0cc7241d8b, 37537e42e6df387398bee85cb85070cc80bb1e10, 4cefe32639933d652614b0bd50f818f9af4af78f, 0511ecb00e61bf28e2fec4bb41fcce385c3a3b2d, d42bec6e4f6d6d658be365539400b3314b76b2a7, 4c1367a2d7aad643a6f87c6931b13cc1a25e8ca7 |
| Linux/Linuxgeneric | 2.6.12 | Not reported |
Published upstream
May 27, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jun 26, 2026
In the Linux kernel, the following vulnerability has been resolved: slip: bound decode() reads against the compressed packet length slhc_uncompress() parses a VJ-compressed TCP header by advancing a pointer through the packet via decode() and pull16(). Neither helper bounds-checks against isize, and decode() masks its return with & 0xffff so it can never return the -1 that callers test for -- those error paths are dead code. A short compressed frame whose change byte requests optional fields lets decode() read past the end of the packet. The over-read bytes are folded into the cached cstate and reflected into subsequent reconstructed packets. Make decode() and pull16() take the packet end pointer and return -1 when exhausted. Add a bounds check before the TCP-checksum read. The existing == -1 tests now do what they were always meant to.
Quoted source text, attributed separately from HOL analysis.