---
id: CVE-2026-74569
title: 'netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp()

  sip_help_tcp() stores the size change of each NAT-rewritten SIP message
  in s16 diff and a…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= f5b321bd37fbec9188feb1f721ab46a5ac0b35da <
    ed1f9be6dc8e2e280b8725e44ccdc6e0cd38640d
  - >-
    Linux >= f5b321bd37fbec9188feb1f721ab46a5ac0b35da <
    1b0843f9e9b9b0b9b4b70d143b67e58163c85b2c
  - >-
    Linux >= f5b321bd37fbec9188feb1f721ab46a5ac0b35da <
    32d4abc8923b0d4046fd63ad6e4917872e44eb6d
  - >-
    Linux >= f5b321bd37fbec9188feb1f721ab46a5ac0b35da <
    63eea41759fd682229c14e0a2205802b46d106f3
  - >-
    Linux >= f5b321bd37fbec9188feb1f721ab46a5ac0b35da <
    c97621a110e386b2dd69e276eb699e1d3cec581d
  - >-
    Linux >= f5b321bd37fbec9188feb1f721ab46a5ac0b35da <
    f74554e67ccf04d1fa71069e8c9afa2717e40716
  - >-
    Linux >= f5b321bd37fbec9188feb1f721ab46a5ac0b35da <
    ef5e2c6555d2bb52dfe0e4053a8c6193f9d83b64
  - >-
    Linux >= f5b321bd37fbec9188feb1f721ab46a5ac0b35da <
    db3d0e0e5d4bc5ab4fe445b9f413d1b486508ca5
  - Linux 2.6.34
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-10-16T19:00:29.648445Z'
published: '2026-08-15'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T19:05:56.675Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-74569'
references:
  - url: 'https://git.kernel.org/stable/c/ed1f9be6dc8e2e280b8725e44ccdc6e0cd38640d'
  - url: 'https://git.kernel.org/stable/c/1b0843f9e9b9b0b9b4b70d143b67e58163c85b2c'
  - url: 'https://git.kernel.org/stable/c/32d4abc8923b0d4046fd63ad6e4917872e44eb6d'
  - url: 'https://git.kernel.org/stable/c/63eea41759fd682229c14e0a2205802b46d106f3'
  - url: 'https://git.kernel.org/stable/c/c97621a110e386b2dd69e276eb699e1d3cec581d'
  - url: 'https://git.kernel.org/stable/c/f74554e67ccf04d1fa71069e8c9afa2717e40716'
  - url: 'https://git.kernel.org/stable/c/ef5e2c6555d2bb52dfe0e4053a8c6193f9d83b64'
  - url: 'https://git.kernel.org/stable/c/db3d0e0e5d4bc5ab4fe445b9f413d1b486508ca5'
tags:
  - cve.org
epss: 0.00388
epssPercentile: 0.31307
ingestedAt: '2026-10-16T19:46:24.341Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp()

sip_help_tcp() stores the size change of each NAT-rewritten SIP message
in s16 diff and accumulates it in s16 tdiff, but a single message can
grow by more than S16_MAX while the packet stays under the 65535
enlarge_skb() limit: nf_nat_sip() rewrites every matching URI, and a long
Contact list expands the message by tens of kilobytes. diff then wraps,
and "datalen = datalen + diff - msglen" yields a huge unsigned datalen,
so the next iteration's ct_sip_get_header() reads past the linearized skb
tail.

Widen diff, tdiff and the seq_adjust hook to s32. Both are bounded by the
65535 byte packet limit, and the seqadj core is already s32
(nf_ct_seqadj_set() takes s32), so no previously accepted input is
rejected.

  BUG: KASAN: use-after-free in ct_sip_get_header (net/netfilter/nf_conntrack_sip.c:464)
  Read of size 1 at addr ffff888010800000 by task ksoftirqd/1/25
   ct_sip_get_header (net/netfilter/nf_conntrack_sip.c:464)
   sip_help_tcp (net/netfilter/nf_conntrack_sip.c:1694)
   nf_confirm (net/netfilter/nf_conntrack_proto.c:183)
   nf_hook_slow (net/netfilter/core.c:619)
   ip6_output (net/ipv6/ip6_output.c:246)
   ip6_forward (net/ipv6/ip6_output.c:690)
   ipv6_rcv (net/ipv6/ip6_input.c:351)
   __netif_receive_skb_one_core (net/core/dev.c:6212)
   process_backlog (net/core/dev.c:6676)
   __napi_poll (net/core/dev.c:7735)
   net_rx_action (net/core/dev.c:7955)
   handle_softirqs (kernel/softirq.c:622)
   run_ksoftirqd (kernel/softirq.c:1076)
   ...

## Affected

- `Linux >= f5b321bd37fbec9188feb1f721ab46a5ac0b35da < ed1f9be6dc8e2e280b8725e44ccdc6e0cd38640d`
- `Linux >= f5b321bd37fbec9188feb1f721ab46a5ac0b35da < 1b0843f9e9b9b0b9b4b70d143b67e58163c85b2c`
- `Linux >= f5b321bd37fbec9188feb1f721ab46a5ac0b35da < 32d4abc8923b0d4046fd63ad6e4917872e44eb6d`
- `Linux >= f5b321bd37fbec9188feb1f721ab46a5ac0b35da < 63eea41759fd682229c14e0a2205802b46d106f3`
- `Linux >= f5b321bd37fbec9188feb1f721ab46a5ac0b35da < c97621a110e386b2dd69e276eb699e1d3cec581d`
- `Linux >= f5b321bd37fbec9188feb1f721ab46a5ac0b35da < f74554e67ccf04d1fa71069e8c9afa2717e40716`
- `Linux >= f5b321bd37fbec9188feb1f721ab46a5ac0b35da < ef5e2c6555d2bb52dfe0e4053a8c6193f9d83b64`
- `Linux >= f5b321bd37fbec9188feb1f721ab46a5ac0b35da < db3d0e0e5d4bc5ab4fe445b9f413d1b486508ca5`
- `Linux 2.6.34`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.