CVE-2026-74569

Status: UPDATED  |  Advisory ID: CVE-2026-74569

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp()

sip_help_tcp() stores the size change of each NAT-rewritten SIP message

in s16 diff and accumulates it in s16 tdiff, but a single message can

grow by more than S16_MAX while the packet stays under the 65535

enlarge_skb() limit: nf_nat_sip() rewrites every matching URI, and a long

Contact list expands the message by tens of kilobytes. diff then wraps,

and "datalen = datalen + diff - msglen" yields a huge unsigned datalen,

so the next iteration's ct_sip_get_header() reads past the linearized skb

tail.

Widen diff, tdiff and the seq_adjust hook to s32. Both are bounded by the

65535 byte packet limit, and the seqadj core is already s32

(nf_ct_seqadj_set() takes s32), so no previously accepted input is

rejected.

BUG: KASAN: use-after-free in ct_sip_get_header (net/netfilter/nf_conntrack_sip.c:464)

Read of size 1 at addr ffff888010800000 by task ksoftirqd/1/25

ct_sip_get_header (net/netfilter/nf_conntrack_sip.c:464)

sip_help_tcp (net/netfilter/nf_conntrack_sip.c:1694)

nf_confirm (net/netfilter/nf_conntrack_proto.c:183)

nf_hook_slow (net/netfilter/core.c:619)

ip6_output (net/ipv6/ip6_output.c:246)

ip6_forward (net/ipv6/ip6_output.c:690)

ipv6_rcv (net/ipv6/ip6_input.c:351)

__netif_receive_skb_one_core (net/core/dev.c:6212)

process_backlog (net/core/dev.c:6676)

__napi_poll (net/core/dev.c:7735)

net_rx_action (net/core/dev.c:7955)

handle_softirqs (kernel/softirq.c:622)

run_ksoftirqd (kernel/softirq.c:1076)

... (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References