CVE-2026-31427

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp

process_sdp() declares union nf_inet_addr rtp_addr on the stack and

passes it to the nf_nat_sip sdp_session hook after walking the SDP

media descriptions. However rtp_addr is only initialized inside the

media loop when a recognized media type with a non-zero port is found.

If the SDP body contains no m= lines, only inactive media sections

(m=audio 0 ...) or only unrecognized media types, rtp_addr is never

assigned. Despite that, the function still calls hooks->sdp_session()

with &rtp_addr, causing nf_nat_sdp_session() to format the stale stack

value as an IP address and rewrite the SDP session owner and connection

lines with it.

With CONFIG_INIT_STACK_ALL_ZERO (default on most distributions) this

results in the session-level o= and c= addresses being rewritten to

0.0.0.0 for inactive SDP sessions. Without stack auto-init the

rewritten add

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References