Executive brief
A vulnerability was identified in the Linux kernel's Netfilter component, which handles network traffic filtering and connection tracking for SIP (Session Initiation Protocol) communications. The issue involves unsafe processing of network packets that could allow malformed data to bypass security checks or cause unexpected behavior. This affects systems using Linux-based firewalls or routers that monitor VoIP (Voice over IP) traffic.
Technical details
A vulnerability in nf_conntrack_sip was caused by the use of simple_strtoul() on non-NUL-terminated socket buffer (skb) data. The functions epaddr_len(), ct_sip_parse_header_uri(), and ct_sip_parse_request() performed pointer dereferencing without sufficient bounds checks after calling sip_parse_addr(). An attacker could potentially exploit this by sending specially crafted SIP packets. The fix replaces simple_strtoul() with a new sip_parse_port() helper that validates each digit against the buffer limit and enforces stricter base-10 parsing for numerical parameters. The patch also ensures that parsed port values are within the valid 1k-64k range in nf_nat_sip.c.
Affected products
- Linux Linux Kernel 05e3ced297fe to 8cd035837957
Timeline
- 2026-04-23: other: Patch authored by Florian Westphal
- 2026-05-23: patched: Patch committed to stable tree
- 2026-06-24: disclosed: CVE-2026-52986 published
References
- https://git.kernel.org/stable/c/523762e3b6933fff81f01dfa3c60c0774044cdab
- https://git.kernel.org/stable/c/7df9863bf538a626e8a684e59cb2c43eac0ef3c8
- https://git.kernel.org/stable/c/8cd0358379570003659186706e077929d6930c40
- https://git.kernel.org/stable/c/8cf6809cddcbe301aedfc6b51bcd4944d45795f6
- https://git.kernel.org/stable/c/9c6afcb1c3cbb2c0da65b8515ac14d7273872f84
- https://git.kernel.org/stable/c/9f69c323ae0ab517e595c2cc74e0ae0d9d085611
- https://git.kernel.org/stable/c/b3264c977e79d8a25778d4fd11520f00fea1329c