CVE-2026-72251 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_nat_sip: reload possible stale data pointer
quoting sashiko: ------------------------------------------------------------------------ [..] noticed a potential memory bug and header corruption involving the
SIP NAT helper.
In net/netfilter/nf_nat_sip.c:nf_nat_sip(): if (skb_ensure_writable(skb, skb->len)) {
nf_ct_helper_log(skb, ct, "cannot mangle packet"); return NF_DROP; } uh = (void *)skb->data + protoff; uh->dest = ct_sip_info->forced_dport; if (!nf_nat_mangle_udp_packet(skb, ct, ctinfo, protoff, 0, 0, NULL, 0)) {
If a cloned or fragmented SKB is reallocated by skb_ensure_writable(), the old data buffer is freed. However, nf_nat_sip() fails to update *dptr to point to the new buffer.
It also appears to use nf_nat_mangle_udp_packet() on what could be a TCP packet, which would overwrite the sequence number with a checksum update. ------------------------------------------------------------------------
nf_conntrack_sip linerizes skbs, hence no fragmented skb can be seen. But clones are possible, so rebuild dptr.
Disable nf_nat_mangle_udp_packet() branch for TCP streams. It doesn't look like this can ever happen, else we should have received bug reports about this, so just check the conntrack is UDP and drop otherwise.
The calling conntrack_sip set ->forced_dport for SIP_HDR_VIA_UDP messages, so I don't think this is ever expected to be true for a TCP stream.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability resides within the Linux kernel's netfilter subsystem, specifically in the nf_nat_sip helper module responsible for handling Session Initiation Protocol traffic. This flaw manifests as a potential memory corruption issue that could lead to system instability or arbitrary code execution when processing SIP packets through NAT translation. The vulnerability stems from improper handling of cloned socket buffers during packet mangling operations, creating a scenario where stale data pointers remain referenced after memory reallocation.
The technical implementation issue occurs in the nf_nat_sip function within net/netfilter/nf_nat_sip.c where the code calls skb_ensure_writable() to ensure sufficient buffer space for packet modification. When this function triggers reallocation of the socket buffer, particularly in scenarios involving cloned packets, the data pointer dptr is not properly updated to reference the new memory location. This creates a dangling pointer condition that can result in memory corruption when subsequent operations attempt to access the freed buffer region. The vulnerability is further exacerbated by the incorrect use of nf_nat_mangle_udp_packet() function on what could potentially be TCP packets, as this function is designed specifically for UDP packet manipulation and would corrupt TCP sequence numbers during checksum updates.
This vulnerability has significant operational impact within network infrastructure deployments that rely on SIP NAT traversal, particularly in VoIP systems, unified communications platforms, and network address translation implementations. The memory corruption could lead to kernel panics, system crashes, or unpredictable behavior in network services handling SIP traffic. Attackers could potentially exploit this weakness by crafting malicious SIP packets that trigger the specific code path involving cloned buffers and subsequent buffer reallocation. The issue affects systems running Linux kernels with netfilter functionality enabled, particularly those implementing SIP NAT helpers for VoIP services.
The fix implements two primary defensive measures to address the vulnerability. First, it ensures proper pointer management by updating the data pointer dptr after any successful buffer reallocation performed by skb_ensure_writable(), preventing access to freed memory regions. Second, the implementation adds explicit protocol checking to prevent the use of nf_nat_mangle_udp_packet() on TCP streams, as this function is inappropriate for TCP packet manipulation and would corrupt TCP sequence numbers. The solution leverages the existing conntrack_sip module's behavior of linerizing skbs, which prevents fragmented packets from reaching this code path, while still addressing the clone scenario that could occur in the network processing pipeline. This approach aligns with security best practices for memory management in kernel space and follows established patterns for preventing use-after-free conditions.
The vulnerability maps to CWE-416: Use After Free and CWE-125: Out-of-Bounds Read, both of which are critical memory safety issues commonly found in kernel-level implementations. From an ATT&CK perspective, this represents a potential privilege escalation vector through kernel memory corruption, with T1068: Exploitation for Privilege Escalation and T1595.001: Network Denial of Service as relevant techniques. The fix addresses these issues by implementing proper memory lifecycle management and protocol validation, ensuring that the network stack maintains consistency in packet handling operations while preventing unauthorized access to freed kernel memory regions that could be exploited for privilege escalation or denial of service attacks.