Junglewise Threat Intelligence

CVE-2026-31427: Linux Kernel uninitialized memory use in netfilter nf_conntrack_sip

CVE-2026-31427 · Severity: medium · CVSS 5.5 · Published 2026-04-13

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's networking subsystem could allow a local attacker to cause a system malfunction or crash. The issue exists in the component responsible for tracking SIP (Session Initiation Protocol) traffic, commonly used for voice and video calls. If exploited, it can lead to incorrect network address processing, potentially disrupting communication services or causing system instability.

Technical details

A use of uninitialized resource vulnerability (CWE-908) exists in the nf_conntrack_sip module of the Linux kernel. In the process_sdp() function, the rtp_addr variable is declared on the stack but only initialized if specific media types with non-zero ports are found. If an SDP body contains no m= lines or only inactive/unrecognized media types, the uninitialized rtp_addr is passed to the sdp_session hook. This causes nf_nat_sdp_session() to use stale stack data (or 0.0.0.0 if stack auto-init is enabled) to rewrite SDP session owner and connection lines. An attacker could potentially leverage this to cause a denial of service. Patches have been released across multiple stable kernel branches.

Affected products

  • Linux Linux Kernel 2.6.26 to 5.10.253, 5.11 to 5.15.203, 5.16 to 6.1.168, 6.2 to 6.6.131, 6.7 to 6.12.80, 6.13 to 6.18.21, 6.19 to 6.19.11

Timeline

  • 2026-04-13: advisory: Initial disclosure and CVE assignment
  • 2026-03-26: patched: Mainline kernel patch committed

References

Related threats