Detections
Analytics

Google: sys-kernel/csql-kernel-6_1, sys-kernel/csql-kernel-6_6, sys-kernel/lakitu-kernel-6_1, sys-kernel/lakitu-kernel-6_6, sys-kernel/lakitu-nc-kernel-6_6, sys-kernel/lakitu-vgpu-kernel-6_6, sys-kernel/tpusev-kernel-6_6: security update to 18613.613.40

medium Tenable Self-Hosted Container Security Plugin ID 467261

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: slip: reject VJ receive packets on
 instances with no rstate array slhc_init() accepts rslots == 0 as a valid configuration, with the
 documented meaning of 'no receive compression'. In that case the allocation loop in slhc_init() is
 skipped, so comp->rstate stays NULL and comp->rslot_limit stays 0 (from the kzalloc of struct slcompress).
 The receive helpers do not defend against that configuration. slhc_uncompress() dereferences
 comp->rstate[x] when the VJ header carries an explicit connection ID, and slhc_remember() later assigns cs
 = &comp->rstate[...] after only comparing the packet's slot number to comp->rslot_limit. Because
 rslot_limit is 0, slot 0 passes the range check, and the code dereferences a NULL rstate. The
 configuration is reachable in-tree through PPP. PPPIOCSMAXCID stores its argument in a signed int, and
 (val >> 16) uses arithmetic shift. Passing 0xffff0000 therefore sign-extends to -1, so val2 + 1 is 0 and
 ppp_generic.c ends up calling slhc_init(0, 1). Because /dev/ppp open is gated by
 ns_capable(CAP_NET_ADMIN), the whole path is reachable from an unprivileged user namespace. Once the
 malformed VJ state is installed, any inbound VJ-compressed or VJ-uncompressed frame that selects slot 0
 crashes the kernel in softirq context: Oops: general protection fault, probably for non-canonical address
 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range
 [0x0000000000000000-0x0000000000000007] RIP: 0010:slhc_uncompress (drivers/net/slip/slhc.c:519) Call
 Trace: <TASK> ppp_receive_nonmp_frame (drivers/net/ppp/ppp_generic.c:2466) ppp_input
 (drivers/net/ppp/ppp_generic.c:2359) ppp_async_process (drivers/net/ppp/ppp_async.c:492)
 tasklet_action_common (kernel/softirq.c:926) handle_softirqs (kernel/softirq.c:623) run_ksoftirqd
 (kernel/softirq.c:1055) smpboot_thread_fn (kernel/smpboot.c:160) kthread (kernel/kthread.c:436)
 ret_from_fork (arch/x86/kernel/process.c:164) </TASK> Reject the receive side on such instances instead of
 touching rstate. slhc_uncompress() falls through to its existing 'bad' label, which bumps sls_i_error and
 enters the toss state. slhc_remember() mirrors that with an explicit sls_i_error increment followed by
 slhc_toss(); the sls_i_runt counter is not used here because a missing rstate is an internal configuration
 state, not a runt packet. The transmit path is unaffected: the only in-tree caller that picks rslots from
 userspace (ppp_generic.c) still supplies tslots >= 1, and slip.c always calls slhc_init(16, 16), so
 comp->tstate remains valid and slhc_compress() continues to work. (CVE-2026-45842)

Solution

Update the sys-kernel/csql-kernel-6_1 library and its related packages to version 18613.613.40 or later.

See Also

https://storage.googleapis.com/cos-oval-vulnerability-feed/cos-117.oval.xml.tar.gz

Plugin Details

Severity: Medium

ID: 467261

Version: Revision 1.3

Type: Local

Published: 10/2/2026

Updated: 10/3/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 5

Percentile: 93.7

Vendor

Vendor Severity: MEDIUM

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.4

Vector: CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C

CVSS Score Source: CVE-2026-45842

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 5/27/2026

Reference Information

CVE: CVE-2026-45842