CVE-2026-45843

In the Linux kernel, the following vulnerability has been resolved:

slip: bound decode() reads against the compressed packet length

slhc_uncompress() parses a VJ-compressed TCP header by advancing a

pointer through the packet via decode() and pull16(). Neither helper

bounds-checks against isize, and decode() masks its return with

& 0xffff so it can never return the -1 that callers test for -- those

error paths are dead code.

A short compressed frame whose change byte requests optional fields

lets decode() read past the end of the packet. The over-read bytes

are folded into the cached cstate and reflected into subsequent

reconstructed packets.

Make decode() and pull16() take the packet end pointer and return -1

when exhausted. Add a bounds check before the TCP-checksum read.

The existing == -1 tests now do what they were always meant to.