---
id: CVE-2026-98077
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace()

  sip_skip_whitespace() returns dptr unchanged when its own loop
  exhausts the buffer (dptr == limit), …
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace()

  sip_skip_whitespace() returns dptr unchanged when its own loop
  exhausts the buffer (dptr == limit), …
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= ea45f12a2766dae54e5426a23e8f4bafdbe2782e <
    60c012b2d05e1558b0f30ea3f15a2c3ca2f24d94
  - >-
    Linux >= ea45f12a2766dae54e5426a23e8f4bafdbe2782e <
    4be8380e3af008f418f97992c06f23be649a430d
  - >-
    Linux >= ea45f12a2766dae54e5426a23e8f4bafdbe2782e <
    4a30aa2ba007db18210dd52219ecbd5528c03523
  - >-
    Linux >= ea45f12a2766dae54e5426a23e8f4bafdbe2782e <
    e8f8231824b5815f57ce62cba116e511b10196de
  - Linux 2.6.26
published: '2026-09-25'
updated: '2026-09-25'
sourceUpdated: '2026-09-25T11:17:37.090'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-98077'
references:
  - url: 'https://git.kernel.org/stable/c/4a30aa2ba007db18210dd52219ecbd5528c03523'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/4be8380e3af008f418f97992c06f23be649a430d'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/60c012b2d05e1558b0f30ea3f15a2c3ca2f24d94'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/e8f8231824b5815f57ce62cba116e511b10196de'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-25T11:06:38.837Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace()

sip_skip_whitespace() returns dptr unchanged when its own loop
exhausts the buffer (dptr == limit), instead of NULL like its sibling
sip_follow_continuation() returns on its own "no more data" path.

ct_sip_get_header() only checks for NULL after calling it:

  dptr = sip_skip_whitespace(dptr, limit);
  if (dptr == NULL)
          break;
  if (*dptr != ':' || ++dptr >= limit)
          break;

so a recognized header name followed only by spaces/tabs running to
the exact end of the SIP payload, with no colon, makes the very next
statement read one byte past the buffer.

Make both "no more data" outcomes return NULL, matching the
convention sip_follow_continuation() already uses and that both
existing callers already check for.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.