Out-of-bounds read in Linux kernel SLIP VJ header decompression

CVE-2026-45843 is an out-of-bounds read vulnerability in the Linux kernel SLIP subsystem, specifically in the VJ-compressed TCP header decompression path handled by slhc_uncompress(). The vulnerable code advances through compressed packet data using the helpers decode() and pull16(), but those helpers did not properly enforce bounds against the compressed packet length. In addition, decode() masked its return value with & 0xffff, which prevented it from ever returning -1 as intended by callers, leaving existing error-handling paths effectively dead code. A crafted short compressed frame whose change byte requests optional fields can cause decode() to read past the end of the packet buffer. The over-read bytes may then be incorporated into the cached connection state (cstate) and reflected into subsequently reconstructed packets. The fix changes decode() and pull16() to take a packet end pointer and return -1 when packet data is exhausted, and adds an explicit bounds check before reading the TCP checksum.