CVE-2026-74569

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp()

sip_help_tcp() stores the size change of each NAT-rewritten SIP message

in s16 diff and accumulates it in s16 tdiff, but a single message can

grow by more than S16_MAX while the packet stays under the 65535

enlarge_skb() limit: nf_nat_sip() rewrites every matching URI, and a long

Contact list expands the message by tens of kilobytes. diff then wraps,

and "datalen = datalen + diff - msglen" yields a huge unsigned datalen,

so the next iteration's ct_sip_get_header() reads past the linearized skb

tail.

Widen diff, tdiff and the seq_adjust hook to s32. Both are bounded by the

65535 byte packet limit, and the seqadj core is already s32

(nf_ct_seqadj_set() takes s32), so no previously accepted input is

rejected.

BUG: KASAN: use-after-free in ct_sip_get_header (net/netfilter/nf_conntrack_sip.c:464)

Read of size 1 at addr ffff888010800000 by

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References