Junglewise Threat Intelligence

CVE-2026-23457: Linux Kernel Netfilter SIP truncation in sip_help_tcp

CVE-2026-23457 · Severity: high · CVSS 8.6 · Published 2026-04-03

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability exists in the Linux kernel's Netfilter component, which handles network traffic filtering and connection tracking for the SIP protocol (commonly used for VoIP and video calls). An attacker can send specially crafted SIP messages that cause the system to miscalculate message boundaries, potentially leading to unauthorized data processing or service disruptions. This affects systems using 64-bit Linux kernels that perform SIP connection tracking.

Technical details

A vulnerability in `sip_help_tcp()` within `net/netfilter/nf_conntrack_sip.c` occurs because the SIP `Content-Length` header is parsed using `simple_strtoul()` (returning `unsigned long`) but stored in an `unsigned int`. On 64-bit systems, values exceeding `UINT_MAX` are truncated. This truncation causes the parser to miscalculate the SIP message boundary, leading the loop to treat trailing data in a TCP segment as a subsequent SIP message. This secondary 'message' is then processed by the SDP parser, potentially allowing an attacker to bypass security filters or cause unexpected behavior. The fix involves using `unsigned long` for the length variable and adding checks to ensure the length does not exceed the remaining payload.

Affected products

  • Linux Linux Kernel 2.6.34 to 5.10.253, 5.11 to 5.15.203, 5.16 to 6.1.167, 6.2 to 6.6.130, 6.7 to 6.12.78, 6.13 to 6.18.20, 6.19 to 6.19.10, 7.0-rc1 to 7.0-rc4

Timeline

  • 2026-03-10: other: Vulnerability fix authored
  • 2026-04-03: disclosed: Initial disclosure and publication
  • 2026-04-03: patched: Patches released in various stable kernel branches

References

Related threats