CVE-2026-74569 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp()
sip_help_tcp() stores the size change of each NAT-rewritten SIP message in s16 diff and accumulates it in s16 tdiff, but a single message can grow by more than S16_MAX while the packet stays under the 65535 enlarge_skb() limit: nf_nat_sip() rewrites every matching URI, and a long Contact list expands the message by tens of kilobytes. diff then wraps, and "datalen = datalen + diff - msglen" yields a huge unsigned datalen, so the next iteration's ct_sip_get_header() reads past the linearized skb tail.
Widen diff, tdiff and the seq_adjust hook to s32. Both are bounded by the 65535 byte packet limit, and the seqadj core is already s32 (nf_ct_seqadj_set() takes s32), so no previously accepted input is rejected.
BUG: KASAN: use-after-free in ct_sip_get_header (net/netfilter/nf_conntrack_sip.c:464) Read of size 1 at addr ffff888010800000 by task ksoftirqd/1/25 ct_sip_get_header (net/netfilter/nf_conntrack_sip.c:464) sip_help_tcp (net/netfilter/nf_conntrack_sip.c:1694) nf_confirm (net/netfilter/nf_conntrack_proto.c:183) nf_hook_slow (net/netfilter/core.c:619) ip6_output (net/ipv6/ip6_output.c:246) ip6_forward (net/ipv6/ip6_output.c:690) ipv6_rcv (net/ipv6/ip6_input.c:351) __netif_receive_skb_one_core (net/core/dev.c:6212) process_backlog (net/core/dev.c:6676) __napi_poll (net/core/dev.c:7735) net_rx_action (net/core/dev.c:7955) handle_softirqs (kernel/softirq.c:622) run_ksoftirqd (kernel/softirq.c:1076) ...
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability described in this CVE relates to a critical flaw within the Linux kernel's netfilter subsystem, specifically within the nf_conntrack_sip module responsible for handling Session Initiation Protocol messages. This issue manifests as an integer overflow that occurs during NAT rewriting operations on SIP traffic, creating potential for memory corruption and system instability.
The technical root cause stems from insufficient data type sizing in the sip_help_tcp() function where it stores size changes of NAT-rewritten SIP messages using 16-bit signed integers (s16) for both individual message differences (diff) and accumulated totals (tdiff). When processing SIP messages containing extensive Contact headers or other URI elements that require significant expansion during NAT translation, a single message can grow beyond the maximum value representable by s16, which is 32767 bytes. This overflow causes the diff variable to wrap around to negative values, leading to incorrect calculations in the subsequent formula "datalen = datalen + diff - msglen". The resulting large unsigned datalen value causes ct_sip_get_header() to read past the linearized socket buffer tail, triggering a use-after-free condition as demonstrated by the KASAN report showing memory access at address ffff888010800000.
This vulnerability directly maps to CWE-190: Integer Overflow or Wraparound and aligns with ATT&CK technique T1059.007: Command and Scripting Interpreter: Python, though more specifically relates to kernel-level memory corruption. The operational impact is severe as it enables attackers to potentially execute arbitrary code within the kernel context through crafted SIP traffic that triggers the overflow condition during NAT processing. The attack vector requires the presence of a SIP server or proxy with NAT traversal capabilities, making it particularly dangerous in VoIP environments and enterprise network infrastructures where such services are prevalent.
The mitigation strategy involves widening the data types from s16 to s32 for all affected variables including diff, tdiff, and the seq_adjust hook within the sip_help_tcp() function. This change ensures that the values can accommodate the full range of possible message size changes while remaining bounded by the inherent 65535 byte packet limit imposed by the enlarge_skb() function. The fix maintains backward compatibility since all previously accepted inputs remain valid, and the underlying seqadj core already operates with s32 parameters through nf_ct_seqadj_set() function. This patch demonstrates proper defensive programming practices in kernel space where integer overflow protection is essential for preventing memory corruption vulnerabilities that could lead to privilege escalation or system compromise.
The KASAN use-after-free error trace reveals a clear execution path from the sip_help_tcp() function through the netfilter confirmation process, ultimately reaching the IPv6 output handling layer. This indicates how the corrupted memory access propagates through the kernel networking stack, confirming the severity of the vulnerability and its potential for causing system crashes or more sophisticated exploitation scenarios. The fix addresses the fundamental integer overflow issue while preserving all existing functionality and maintaining the security model's integrity within the Linux kernel's connection tracking framework.