Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() sip_help_tcp() stores the size change of each NAT-rewritten SIP message in s16 diff and accumulates it in s16 tdiff, but a single message can grow by more than S16_MAX while the packet stays under the 65535 enlarge_skb() limit: nf_nat_sip() rewrites every matching URI, and a long Contact list expands the message by tens of kilobytes. diff then wraps, and "datalen = datalen + diff - msglen" yields a huge unsigned datalen, so the next iteration's ct_sip_get_header() reads past the linearized skb tail. Widen diff, tdiff and the seq_adjust hook to s32. Both are bounded by the 65535 byte packet limit, and the seqadj core is already s32 (nf_ct_seqadj_set() takes s32), so no previously accepted input is rejected. BUG: KASAN: use-after-free in ct_sip_get_header (net/netfilter/nf_conntrack_sip.c:464) Read of size 1 at addr ffff888010800000 by task ksoftirqd/1/25 ct_sip_get_header (net/netfilter/nf_conntrack_sip.c:464) sip_help_tcp (net/netfilter/nf_conntrack_sip.c:1694) nf_confirm (net/netfilter/nf_conntrack_proto.c:183) nf_hook_slow (net/netfilter/core.c:619) ip6_output (net/ipv6/ip6_output.c:246) ip6_forward (net/ipv6/ip6_output.c:690) ipv6_rcv (net/ipv6/ip6_input.c:351) __netif_receive_skb_one_core (net/core/dev.c:6212) process_backlog (net/core/dev.c:6676) __napi_poll (net/core/dev.c:7735) net_rx_action (net/core/dev.c:7955) handle_softirqs (kernel/softirq.c:622) run_ksoftirqd (kernel/softirq.c:1076) ...

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-15T13:18:02.517Z",
  "pubdate": "2026-08-15T13:18:02.517Z",
  "executiveSummary": "An integer overflow vulnerability exists in the Linux kernel netfilter subsystem within the nf_conntrack_sip module, specifically in the sip_help_tcp() function.\nThe vulnerability is caused by utilizing a 16-bit signed integer (s16) to track and accumulate the size changes (diff and tdiff) of NAT-rewritten SIP messages, while a single packet can grow beyond S16_MAX due to repeated URI rewrites and long Contact lists.\nWhen a SIP message expands beyond the s16 capacity, the integer wraps around, causing datalen calculations to yield a massive unsigned integer value.\nThis arithmetic error leads to a use-after-free or out-of-bounds read condition when ct_sip_get_header() attempts to read past the linearized socket buffer (skb) tail.\nAn attacker capable of sending specially crafted SIP packets over TCP can trigger this condition, potentially resulting in kernel memory corruption, denial of service (system crash via KASAN use-after-free), or potential information disclosure.\nThe vulnerability affects network-exposed Linux kernel environments utilizing netfilter connection tracking for the SIP protocol.",
  "technicalDetails": "The vulnerability resides in the Linux kernel netfilter component, specifically within the net/netfilter/nf_conntrack_sip.c file inside the sip_help_tcp() function.\nThe root cause is an improper integer data type selection for tracking size deltas during NAT rewriting operations. The sip_help_tcp() function historically stored the size change of each NAT-rewritten SIP message in an s16 diff variable and accumulated it in an s16 tdiff variable.\nAlthough individual packets are bounded by the 65535-byte enlarge_skb() limit, nf_nat_sip() rewrites every matching Uniform Resource Identifier (URI) within a message. A sufficiently long Contact list can expand a single SIP message by tens of kilobytes, exceeding S16_MAX (32,767 bytes).\nWhen the accumulated growth exceeds the bounds of s16, the diff and tdiff variables overflow and wrap around. Subsequently, the calculation datalen = datalen + diff - msglen yields a massive incorrect unsigned datalen integer.\nBecause the calculated datalen is improperly inflated, subsequent iterations of ct_sip_get_header() and related parsing logic attempt to process data beyond the actual boundaries of the linearized socket buffer (skb), leading to an out-of-bounds read and a KASAN-detected use-after-free panic as observed in the kernel stack trace involving ct_sip_get_header(), sip_help_tcp(), nf_confirm(), and nf_hook_slow().\nExploitation requires an attacker to transmit maliciously crafted SIP over TCP packets designed to maximize URI expansions during NAT rewriting. No special authentication or local privileges are required if the target system processes untrusted SIP traffic through the vulnerable netfilter tracking module."
}