Skip to main content

Linux Kernel CVE-2026-45842

| EUVDEUVD-2026-32168 MEDIUM
NULL Pointer Dereference (CWE-476)
2026-05-27 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-g2vj-v28f-r7cf
Denial Of Service Linux Null Pointer Dereference Canonical
5.5
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Recon
    Create user namespace to gain CAP_NET_ADMIN
  2. Delivery
    Open /dev/ppp device locally
  3. Exploit
    Issue PPPIOCSMAXCID ioctl with 0xffff0000 to install rslots=0
  4. Install
    slhc_init sets rstate=NULL
  5. C2
    Trigger inbound VJ-compressed frame on slot 0
  6. Execute
    NULL dereference in slhc_uncompress softirq
  7. Impact
    Kernel panic, full host DoS

Vulnerability Assessment

Weakness
CWE
CWE-476
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK

1 technique across 1 tactic: Impact

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

The attack requires three specific conditions to be met simultaneously. First, unprivileged user namespaces must be enabled on the target kernel (kernel.unprivileged_userns_clone=1 or equivalent), which is the default on Ubuntu, Fedora, and recent Debian; this allows an unprivileged user to obtain CAP_NET_ADMIN within the namespace and open /dev/ppp. Second, the attacker must be able to issue the PPPIOCSMAXCID ioctl with the crafted value 0xffff0000 to install the malformed VJ compression state (rslots=0). Third, an inbound VJ-compressed or VJ-uncompressed PPP frame must be processed that targets slot 0 - this requires either control over the remote end of a PPP session or the ability to inject frames into the PPP receive path. Exploitation is limited to local access (AV:L); remote-only network attackers without local session presence cannot directly trigger this. Systems that have disabled user namespaces or that do not process untrusted PPP VJ frames have no exposure from this specific attack chain. The transmit path (slhc_compress) is explicitly unaffected.
Impact

The NVD CVSS 3.1 score of 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) is consistent with the technical description: local access, low complexity, low privilege (user namespace CAP_NET_ADMIN), pure availability impact. The score is Medium but the practical attack condition is more accessible than typical PR:L issues on Linux distributions that enable user namespaces by default (Ubuntu, Fedora, Debian with kernel.unprivileged_userns_clone=1). EPSS at 0.02% (5th percentile) reflects no observed exploitation activity and suggests this is not actively targeted at the time of analysis. The vulnerability is not listed in CISA KEV, and no POC has been identified. The impact is a hard kernel panic in softirq context - a guaranteed denial of service affecting the entire host, not just the process. For multi-tenant environments, container platforms, or systems where untrusted users can create namespaces, actual risk is meaningfully higher than the raw CVSS score suggests. Patch availability across many stable branches is confirmed by multiple git.kernel.org stable commits, so remediation is straightforward. Absence of KEV listing and low EPSS indicate this is not a priority for most environments, but namespace-enabled shared systems should patch promptly.
Exploit ScenarioDerived

A local user on a Linux system with user namespaces enabled creates a new user namespace, obtaining CAP_NET_ADMIN within that namespace. They open /dev/ppp and issue the PPPIOCSMAXCID ioctl with value 0xffff0000, which due to signed arithmetic shift causes ppp_generic.c to call slhc_init(0, 1), leaving the receive compression state (rstate) as a NULL pointer. The attacker then arranges for an inbound VJ-compressed PPP frame referencing slot 0 to be processed - achievable by controlling both ends of a PPP link or by injecting a crafted frame - triggering a null pointer dereference in slhc_uncompress() within softirq context and crashing the kernel. No public exploit code has been identified at time of analysis, but the attack chain is mechanically straightforward given the detailed description in the CVE commit message.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 26, 2026

Null pointer dereference in the Linux kernel SLIP header compression (slhc) subsystem crashes the kernel when a VJ-compressed frame is received on a PPP instance configured with zero receive slots. An unprivileged local user who can create a user namespace can invoke the PPPIOCSMAXCID ioctl with a crafted argument (0xffff0000) that exploits a signed-integer arithmetic shift to supply rslots=0 to slhc_init(), leaving comp->rstate NULL; any subsequent inbound VJ frame targeting slot 0 then dereferences that NULL pointer in softirq context, producing a kernel panic. No public exploit has been identified at time of analysis, and EPSS probability is negligible at 0.02%, but the attack path is fully reachable from unprivileged user namespaces, making the practical privilege bar lower than the PR:L label implies on systems where user namespaces are enabled.

RemediationAI

The primary remediation is to upgrade to a patched Linux kernel version: 6.18.33, 6.12.91, 7.0.10, 6.6.141, or 7.1-rc1 or later, depending on the kernel branch in use. Patch commits are available at https://git.kernel.org/stable/c/7b0d9e878ec2b21d99ae8051b3dda59cdb66c152 and related stable-branch commits listed in the NVD references. Distribution users should apply the kernel package update from their vendor (Ubuntu/Canonical, Debian, Red Hat, etc.) which will incorporate the relevant fix commit. As a compensating control where patching is not immediately possible, disabling unprivileged user namespaces eliminates the primary reachability vector: set kernel.unprivileged_userns_clone=0 (Debian/Ubuntu) or kernel.unprivileged_userns_clone equivalents, or use sysctl -w user.max_user_namespaces=0 on distributions supporting it. Note that disabling user namespaces will break sandboxed applications such as browsers (Chrome, Firefox), container runtimes using rootless containers, and snap/flatpak. A narrower alternative is to restrict /dev/ppp access via udev rules to only privileged users, but this impacts legitimate PPP/VPN use. The transmit path is unaffected and does not require mitigation.

Affected VersionsENISA

Linux 42fc512469e78939c1e419d3310c47de55bdcbb8
Linux 4ab42d78e37a294ac7bc56901d563c642e03c4ae <e76607442d5b73e1ba6768f501ef815bb58c2c0e
Linux 3.18.27 <3.19
Linux df085f1cb3acd3d75408ff94f366983873bce7d2
Linux 82185755d90c8047c6f4b589c39998ff3d4ca3ad
Linux 354b254af5c1350de9586af75fe5a821b35bfb33
Linux 3.4.111 <3.5
Linux patch: 6.18.33
Linux patch: 6.12.91
Linux 4ab42d78e37a294ac7bc56901d563c642e03c4ae <c6980e8b1a86288167f34966fa5219031999b6f1
Linux 6b4fa561e26526c62636414d267342c945084f44
Linux 3.2.75 <3.3
Linux a50a93cc99286dc444c7e5ccc7dfb9d58c2d346d
Linux 3.14.60 <3.15
Linux a1c3860d3c5fc62bd35f089bcb03f18a37242de9
Linux 4.1.17 <4.2
Linux 2.6.32.70 <2.6.33
Linux 3.10.96 <3.11
Linux 4ab42d78e37a294ac7bc56901d563c642e03c4ae <7b0d9e878ec2b21d99ae8051b3dda59cdb66c152
Linux 4ab42d78e37a294ac7bc56901d563c642e03c4ae <9e1ff0eead073c4f46d874ad2526b7dda5465faf
Linux 3.12.53 <3.13
Linux 4ab42d78e37a294ac7bc56901d563c642e03c4ae <de42f86e2cf5028a97e74c25869d1a962b13c301
Linux 4.4
Linux f82699de104eaf8a7ffc2849a566a94818dd8a3c
Linux patch: 0
Linux 4.3.5 <4.4
Linux 5148857f5d4c812cc918cf4627f7880521e987eb
Linux patch: 7.0.10
Linux patch: 6.6.141
Linux patch: 7.1-rc1

Affected Packages

euvd linux fix: 2.6.33, 3.3, 3.5, 3.11, 3.13, 3.15, 3.19, 4.2, 4.4

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The vulnerability resides in drivers/net/slip/slhc.c, the Van Jacobson TCP/IP header compression implementation used by both SLIP and PPP networking drivers. slhc_init() accepts rslots=0 as a valid 'no receive compression' configuration and intentionally skips allocating comp->rstate, leaving it NULL and comp->rslot_limit at zero (the kzalloc zeroed state). The flaw (CWE-476, NULL Pointer Dereference) arises because the receive path functions slhc_uncompress() and slhc_remember() lack a guard for this rstate=NULL condition. The reachability vector is PPP: the PPPIOCSMAXCID ioctl in ppp_generic.c stores its argument as a signed int, and arithmetic right-shift of 0xffff0000 by 16 bits produces -1, so val2+1 evaluates to 0, causing ppp_generic.c to call slhc_init(0, 1). Because /dev/ppp is gated only by ns_capable(CAP_NET_ADMIN), an unprivileged user who creates a user namespace holds this capability inside that namespace. The crash manifests in softirq context (KASAN null-ptr-deref at 0x0000000000000000), making it non-recoverable - a full kernel panic. CPE coverage per NVD spans all Linux kernel versions (cpe:2.3:o:linux:linux_kernel:*), indicating broad version impact corrected across multiple stable branches.

Know when Canonical gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI 5.5 MEDIUM

Local access required to open /dev/ppp; PR:L reflects user-namespace CAP_NET_ADMIN; kernel panic is pure high availability impact with no confidentiality or integrity dimension.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE 6.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
Red Hat 5.5 MEDIUM

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
CVSS changed
Jun 26, 2026 - 18:52 NVD
5.5 (MEDIUM)
Patch available
May 27, 2026 - 19:46 EUVD
CVE Published
May 27, 2026 - 11:16 nvd
UNKNOWN (no severity yet)
CVE Published
May 27, 2026 - 11:16 nvd
MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

slip: reject VJ receive packets on instances with no rstate array

slhc_init() accepts rslots == 0 as a valid configuration, with the documented meaning of 'no receive compression'. In that case the allocation loop in slhc_init() is skipped, so comp->rstate stays NULL and comp->rslot_limit stays 0 (from the kzalloc of struct slcompress).

The receive helpers do not defend against that configuration. slhc_uncompress() dereferences comp->rstate[x] when the VJ header carries an explicit connection ID, and slhc_remember() later assigns cs = &comp->rstate[...] after only comparing the packet's slot number to comp->rslot_limit. Because rslot_limit is 0, slot 0 passes the range check, and the code dereferences a NULL rstate.

The configuration is reachable in-tree through PPP. PPPIOCSMAXCID stores its argument in a signed int, and (val >> 16) uses arithmetic shift. Passing 0xffff0000 therefore sign-extends to -1, so val2 + 1 is 0 and ppp_generic.c ends up calling slhc_init(0, 1). Because /dev/ppp open is gated by ns_capable(CAP_NET_ADMIN), the whole path is reachable from an unprivileged user namespace. Once the malformed VJ state is installed, any inbound VJ-compressed or VJ-uncompressed frame that selects slot 0 crashes the kernel in softirq context:

Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:slhc_uncompress (drivers/net/slip/slhc.c:519) Call Trace: <TASK> ppp_receive_nonmp_frame (drivers/net/ppp/ppp_generic.c:2466) ppp_input (drivers/net/ppp/ppp_generic.c:2359) ppp_async_process (drivers/net/ppp/ppp_async.c:492) tasklet_action_common (kernel/softirq.c:926) handle_softirqs (kernel/softirq.c:623) run_ksoftirqd (kernel/softirq.c:1055) smpboot_thread_fn (kernel/smpboot.c:160) kthread (kernel/kthread.c:436) ret_from_fork (arch/x86/kernel/process.c:164) </TASK>

Reject the receive side on such instances instead of touching rstate. slhc_uncompress() falls through to its existing 'bad' label, which bumps sls_i_error and enters the toss state. slhc_remember() mirrors that with an explicit sls_i_error increment followed by slhc_toss(); the sls_i_runt counter is not used here because a missing rstate is an internal configuration state, not a runt packet.

The transmit path is unaffected: the only in-tree caller that picks rslots from userspace (ppp_generic.c) still supplies tslots >= 1, and slip.c always calls slhc_init(16, 16), so comp->tstate remains valid and slhc_compress() continues to work.

Threat Intelligence Overview

EPSS Score
0.0%
Top 95% exploitable
Prevalence
Ubiquitous
Linux kernel deployed across virtually all server, cloud, and embedded environments
Threat Intel
1
1 sources
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS CISA MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat Yes
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact· derived
High

Priority Score

38
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +28
PoC: 0
Weaponized: 0
Threat intel: +10
Gov advisory: 0

Attack Technique

Null Pointer Dereference MEDIUM

A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Canonical

View all
CVE-2011-3544 CRITICAL POC
9.8 Oct 19

Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
CVE-2019-11043 CRITICAL POC
9.8 Oct 28

In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it

CVE-2014-6271 CRITICAL POC
9.8 Sep 24

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
CVE-2013-0422 CRITICAL POC
9.8 Jan 10

Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
CVE-2016-3714 HIGH POC
8.4 May 05

The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.
CVE-2017-12617 HIGH POC
8.1 Oct 04

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTT
CVE-2016-8735 CRITICAL POC
9.8 Apr 06

Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8
CVE-2014-7169 CRITICAL POC
9.8 Sep 25

GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
CVE-2014-0160 HIGH POC
7.5 Apr 07

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
CVE-2016-5195 HIGH POC
7.0 Nov 10

Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev
CVE-2013-2423 LOW POC
3.7 Apr 17

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and
CVE-2023-4911 HIGH POC
7.8 Oct 03

Local privilege escalation in the GNU C Library (glibc) dynamic loader ld.so allows unprivileged local users on affected

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2020-1967 HIGH POC
7.5
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2021-3449 MEDIUM
5.9
CVE-2015-3194 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.158 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.144 Image SL-Micro-Azure Image SL-Micro-BYOS-Azure Image SL-Micro-BYOS-EC2 Image SL-Micro-BYOS-GCE Image SL-Micro-EC2 Image SLE-Micro Image SLE-Micro-Azure Image SLE-Micro-BYOS Image SLE-Micro-BYOS-Azure Image SLE-Micro-BYOS-EC2 Image SLE-Micro-BYOS-GCE Image SLE-Micro-EC2 Image SLE-Micro-GCE Image SUSE-Multi-Linux-Manager-Proxy-BYOS-Azure Image SUSE-Multi-Linux-Manager-Proxy-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-BYOS-Azure Image SUSE-Multi-Linux-Manager-Server-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Server-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-EC2-llc Image SUSE-Multi-Linux-Manager-Server-EC2-ltd Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.173 Container suse/sl-micro/6.1/kvm-os-container:2.2.1-5.144 Affected
Image SLES-Azure-3P Image SLES-Azure-Basic Image SLES-Azure-Standard Image SLES-BYOS-Azure Image SLES-BYOS-EC2 Image SLES-BYOS-GCE Image SLES-EC2 Image SLES-GCE Image SLES-Hardened-BYOS-Azure Image SLES-Hardened-BYOS-EC2 Image SLES-Hardened-BYOS-GCE Affected
Image SLES12-SP5-Azure-BYOS Affected
Image SLES12-SP5-Azure-SAP-BYOS Image SLES12-SP5-Azure-SAP-On-Demand Image SLES12-SP5-EC2-SAP-On-Demand Affected

Threat IntelligenceMISP

CISA Advisories
ICSA-26-295-16
Sources: Microsoft MSRC, CISA (public domain)

References

Advisories & patches
ADVISORY https://ubuntu.com/security/notices/USN-8566-1 ADVISORY https://ubuntu.com/security/notices/USN-8567-1 ADVISORY https://ubuntu.com/security/notices/USN-8568-1 ADVISORY https://vuldb.com/vuln/366048 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22099/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22100/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22108/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22112/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22117/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22127/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22137/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:22140/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2450/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2482/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2591/ REF https://cert-portal.siemens.com/productcert/html/ssa-784472.html REF https://git.kernel.org/stable/c/3d71c961febddd855d3ae9a519eeb96c8023f430 REF https://git.kernel.org/stable/c/4aa9eca6fda2919027dfd7a7cc69334982d89586 REF https://git.kernel.org/stable/c/72304fec672e8aac9ee7b9c475db96b37cca8d8d REF https://git.kernel.org/stable/c/7b0d9e878ec2b21d99ae8051b3dda59cdb66c152 REF https://git.kernel.org/stable/c/9e1ff0eead073c4f46d874ad2526b7dda5465faf REF https://git.kernel.org/stable/c/c6980e8b1a86288167f34966fa5219031999b6f1 REF https://git.kernel.org/stable/c/de42f86e2cf5028a97e74c25869d1a962b13c301 REF https://git.kernel.org/stable/c/e76607442d5b73e1ba6768f501ef815bb58c2c0e

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy