CVE-2026-45842

What it actually does

This is a local denial-of-service vulnerability in the Linux kernel PPP/SLIP Van Jacobson header compression receive path. A user with the ability to obtain CAP_NET_ADMIN inside a user namespace can configure PPP header compression with zero receive slots via PPPIOCSMAXCID, causing the kernel to create a malformed SLHC state where the receive-state array is NULL. When a crafted or malformed inbound VJ-compressed or VJ-uncompressed PPP frame selects slot 0, the receive helper dereferences that NULL state pointer in softirq context, triggering a kernel oops/panic and potentially crashing the system. Confidentiality and integrity are not directly impacted; the primary impact is host availability.

Why it matters to the business

Successful exploitation can crash affected Linux systems, interrupting workloads, network services, containers, virtual machines, or embedded systems that allow local users or containers to create PPP interfaces or obtain network administration capability in a user namespace. The CVSS score is moderate, EPSS is currently low, it is not listed in CISA KEV, and no mature public exploitation is indicated, but the operational impact can still be high on multi-user Linux hosts, container platforms, CI runners, VPN/PPP appliances, or systems where unprivileged user namespaces are enabled.

How an attack unfolds

An attacker first needs local code execution on an affected Linux system or inside a context that can create an unprivileged user namespace and gain CAP_NET_ADMIN within that namespace. The attacker opens /dev/ppp and uses PPP control ioctls, specifically abusing PPPIOCSMAXCID with a value that sign-extends so the receive slot count becomes zero while transmit slots remain valid. This installs an SLHC compression context with no receive-state array. The attacker then causes the PPP receive path to process a VJ-compressed or VJ-uncompressed frame selecting slot 0. Because the receive helper assumes receive state exists, it dereferences a NULL rstate pointer in slhc_uncompress() or slhc_remember(), producing a kernel general protection fault or NULL pointer dereference in softirq handling. Depending on kernel panic/oops policy and workload, this can crash the host or destabilize networking.

How to fix it

Apply the vendor or distribution kernel update that includes the upstream fix to reject VJ receive packets when no receive-state array exists. No specific fixed package versions were provided in the input, so use the latest supported kernel build from the relevant Linux distribution or kernel vendor and verify that it contains the SLIP/SLHC fix for rejecting receive-side VJ packets on instances with zero receive slots. Where immediate patching is not possible, reduce exposure by disabling unprivileged user namespaces where operationally feasible, restricting access to /dev/ppp, preventing untrusted users or containers from obtaining CAP_NET_ADMIN, avoiding privileged containers or broad device passthrough, and unloading or blocking PPP/SLIP-related kernel modules if they are not required. Mitigations should be treated as temporary because they may not cover all legitimate local privilege contexts.

How to confirm the fix worked

Confirm remediation by verifying the running kernel version is at or above the vendor build containing the fix, not merely that a patched package is installed on disk. Review distribution advisories or kernel changelogs for references to the SLIP/SLHC fix that rejects VJ receive packets when rstate is absent. Validate exposure by checking whether unprivileged user namespaces are enabled, whether /dev/ppp exists and is accessible to untrusted users or containers, whether PPP/SLIP modules are loaded or available, and whether containers can run with CAP_NET_ADMIN or device access to /dev/ppp. If safe in a controlled lab only, a regression test can attempt the malformed PPPIOCSMAXCID configuration and verify the kernel rejects the receive path without an oops; do not run proof-of-crash tests on production systems.

Typical attack path

1. Gain local execution on an affected Linux system, container, or namespace-capable environment.
2. Create or enter a user namespace where CAP_NET_ADMIN is available, if permitted by system policy.
3. Open /dev/ppp and configure a PPP channel using ioctl operations.
4. Invoke PPPIOCSMAXCID with a crafted value such as 0xffff0000 so the receive slot count resolves to zero.
5. Install the malformed SLHC/VJ compression receive state through the PPP configuration path.
6. Deliver or trigger processing of a VJ-compressed or VJ-uncompressed PPP frame that selects receive slot 0.
7. Cause the kernel PPP/SLIP receive path to dereference a NULL receive-state pointer.
8. Trigger a kernel oops, panic, or network subsystem crash, resulting in denial of service.

How to detect it

Look for evidence of prior exploitation in kernel logs, system journals, crash dumps, and container/audit telemetry. Relevant log sources include dmesg, /var/log/kern.log, /var/log/messages, journalctl -k, kdump/vmcore analysis, auditd logs for /dev/ppp access, container runtime logs showing CAP_NET_ADMIN or privileged containers, and syscall/ioctl traces if collected by EDR. Indicators include kernel oops or panic messages mentioning NULL pointer dereference, general protection fault, KASAN null-ptr-deref, slhc_uncompress, slhc_remember, ppp_receive_nonmp_frame, ppp_input, ppp_async_process, tasklet_action_common, or ksoftirqd. Also investigate suspicious creation or use of PPP devices by unexpected users, containers, build jobs, or processes, especially shortly before a host crash. Because the vulnerability causes a crash rather than durable file modification, absence of logs after reboot does not prove non-exploitation; use crash dumps and centralized log forwarding where available.

• slhc_uncompress
• slhc_remember
• ppp_receive_nonmp_frame
• ppp_input
• ppp_async_process
• tasklet_action_common
• run_ksoftirqd
• KASAN: null-ptr-deref
• Oops: general protection fault
• NULL pointer dereference
• /dev/ppp
• PPPIOCSMAXCID
• 0xffff0000
• drivers/net/slip/slhc.c
• drivers/net/ppp/ppp_generic.c
• drivers/net/ppp/ppp_async.c
• sls_i_error
• slhc_toss

What your security team should do

• Prioritize patching Linux hosts that allow local users, shared shell access, container workloads, CI jobs, or untrusted workloads with namespace features enabled.
• Inventory systems with PPP, SLIP, /dev/ppp, CAP_NET_ADMIN-capable containers, privileged containers, or unprivileged user namespaces enabled.
• Apply the latest vendor-supported kernel update containing the SLHC receive-state validation fix and reboot into the patched kernel.
• Temporarily restrict /dev/ppp access and remove CAP_NET_ADMIN from untrusted containers or workloads until patching is complete.
• Consider disabling unprivileged user namespaces on systems that do not require them, especially multi-tenant servers and build runners.
• Monitor kernel logs for PPP/SLIP crashes, NULL pointer dereferences, and stack traces involving slhc_uncompress, slhc_remember, or ppp_receive_nonmp_frame.
• Ensure kernel panic/oops handling, crash dump collection, and host auto-recovery controls are configured so availability incidents can be investigated and restored quickly.
• Because EPSS is low and there is no KEV listing or known mature exploit in the supplied data, treat this as a targeted local DoS risk rather than an internet-scale emergency, but patch promptly on exposed multi-user or containerized systems.