CVE-2026-45843: linux Buffer Over-read

Vulnerability summary

CVE-2026-45843 is a high (CVSS 8.2) Buffer Over-read vulnerability in linux. EPSS estimates a 0.55% chance of exploitation in the next 30 days, higher than 44.8% of scored vulnerabilities.

Timeline

1. 27-05-2026
   PublishedVulnerability first disclosed.
2. 19-10-2026
   Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: slip: bound decode() reads against the compressed packet length slhc_uncompress() parses a VJ-compressed TCP header by advancing a pointer through the packet via decode() and pull16(). Neither helper bounds-checks against isize, and decode() masks its return with & 0xffff so it can never return the -1 that callers test for -- those error paths are dead code. A short compressed frame whose change byte requests optional fields lets decode() read past the end of the packet. The over-read bytes are folded into the cached cstate and reflected into subsequent reconstructed packets. Make decode() and pull16() take the packet end pointer and return -1 when exhausted. Add a bounds check before the TCP-checksum read. The existing == -1 tests now do what they were always meant to.

• CWE-126Buffer Over-readThe product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer.