Linux Kernel EUVD-2026-32169

SLIP (Serial Line Internet Protocol) is a legacy point-to-point encapsulation in the Linux networking stack (drivers/net/slip) that optionally supports Van Jacobson TCP/IP header compression (RFC 1144) via slhc.c. The slhc_uncompress() routine walks a compressed frame using decode() (variable-length integer parser) and pull16() (16-bit field reader) to reconstruct the original TCP header. Neither helper validated its pointer against the input buffer end (isize), and decode()'s return value was masked with & 0xffff, so the function could never return -1 - making the caller's '== -1' error checks unreachable. A change byte advertising optional fields can therefore cause the parser to walk past the end of the packet; the over-read bytes are folded into the per-connection cstate and emitted in later reconstructed packets, classifying this as an information-disclosure / out-of-bounds read (CWE-125 class, though CWE is not assigned in the input). The fix introduces an end pointer, returns -1 on exhaustion, and adds an explicit bounds check before the TCP checksum read.