CVE-2026-74569

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nfconntracksip: widen NAT rewrite delta to s32 in siphelptcp()

siphelptcp() stores the size change of each NAT-rewritten SIP message

in s16 diff and accumulates it in s16 tdiff, but a single message can

grow by more than S16_MAX while the packet stays under the 65535

enlargeskb() limit: nfnat_sip() rewrites every matching URI, and a long

Contact list expands the message by tens of kilobytes. diff then wraps,

and "datalen = datalen + diff - msglen" yields a huge unsigned datalen,

so the next iteration's ctsipget_header() reads past the linearized skb

tail.

Widen diff, tdiff and the seq_adjust hook to s32. Both are bounded by the

65535 byte packet limit, and the seqadj core is already s32

(nfctseqadj_set() takes s32), so no previously accepted input is

rejected.

  BUG: KASAN: use-after-free in ctsipgetheader (net/netfilter/nfconntrack_sip.c:464)

  Read of size 1 at addr ffff888010800000 by task ksoftirqd/1/25

   ctsipgetheader (net/netfilter/nfconntrack_sip.c:464)

   siphelptcp (net/netfilter/nfconntracksip.c:1694)

   nfconfirm (net/netfilter/nfconntrack_proto.c:183)

   nfhookslow (net/netfilter/core.c:619)

   ip6output (net/ipv6/ip6output.c:246)

   ip6forward (net/ipv6/ip6output.c:690)

   ipv6rcv (net/ipv6/ip6input.c:351)

   _netifreceiveskbone_core (net/core/dev.c:6212)

   process_backlog (net/core/dev.c:6676)

   _napipoll (net/core/dev.c:7735)

   netrxaction (net/core/dev.c:7955)

   handle_softirqs (kernel/softirq.c:622)

   run_ksoftirqd (kernel/softirq.c:1076)

   ...