CVE-2026-98077
Summary
by MITRE • 09/25/2026
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace()
sip_skip_whitespace() returns dptr unchanged when its own loop exhausts the buffer (dptr == limit), instead of NULL like its sibling sip_follow_continuation() returns on its own "no more data" path.
ct_sip_get_header() only checks for NULL after calling it:
dptr = sip_skip_whitespace(dptr, limit); if (dptr == NULL) break; if (*dptr != ':' || ++dptr >= limit) break;
so a recognized header name followed only by spaces/tabs running to the exact end of the SIP payload, with no colon, makes the very next statement read one byte past the buffer.
Make both "no more data" outcomes return NULL, matching the convention sip_follow_continuation() already uses and that both existing callers already check for.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/25/2026
The Linux kernel vulnerability identified in netfilter's connection tracking subsystem involves a critical out-of-bounds read within the Session Initiation Protocol handling logic. Specifically, the function sip_skip_whitespace exhibits an inconsistent return value behavior when it reaches the end of the input buffer without finding non-whitespace characters. In this scenario, where the pointer dptr equals the limit indicating no more data is available, the function incorrectly returns the unchanged dptr rather than NULL. This deviation from expected error handling protocols creates a dangerous state for subsequent code execution paths that rely on null checks to validate memory access boundaries.
The operational impact of this flaw manifests when processing SIP payloads containing header names followed exclusively by whitespace characters extending to the very end of the buffer without a terminating colon. The calling function ct_sip_get_header invokes sip_skip_whitespace and subsequently performs a check for NULL before attempting to dereference the returned pointer. Because sip_skip_whitespace returns a valid memory address instead of NULL in this edge case, the null check passes erroneously. Consequently, the code proceeds to access *dptr, which points one byte past the allocated buffer limit. This results in an out-of-bounds read operation that can expose kernel memory contents or trigger a general protection fault depending on system configuration and page layout.
From a technical classification perspective, this vulnerability aligns with CWE-125 Out-of-bounds Read, as it involves accessing memory beyond the intended boundary of a buffer. The attack vector typically requires an attacker to craft malicious SIP packets that exploit this specific parsing logic during connection tracking operations. While primarily resulting in information disclosure or denial of service through kernel panic rather than arbitrary code execution due to the read-only nature of the access, such vulnerabilities can potentially aid further exploitation by leaking sensitive kernel data structures. The flaw resides within the ATT&CK framework under techniques related to Discovery and Defense Evasion, specifically involving unauthorized system resource consumption or memory inspection via crafted network traffic targeting network infrastructure components.
Mitigation strategies for this vulnerability involve applying the upstream Linux kernel patch that corrects the return value of sip_skip_whitespace to consistently return NULL when no more data is available. This ensures alignment with the convention established by sibling functions like sip_follow_continuation and satisfies the expectations of existing callers such as ct_sip_get_header. System administrators should prioritize updating their systems to versions containing this fix, particularly those running network-facing services that process SIP traffic or utilize netfilter connection tracking for VoIP applications. Regular patch management and monitoring for kernel updates are essential defenses against exploitation of these types of memory safety issues in the Linux networking stack.