CVE-2026-74569

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp()<br /> <br /> sip_help_tcp() stores the size change of each NAT-rewritten SIP message<br /> in s16 diff and accumulates it in s16 tdiff, but a single message can<br /> grow by more than S16_MAX while the packet stays under the 65535<br /> enlarge_skb() limit: nf_nat_sip() rewrites every matching URI, and a long<br /> Contact list expands the message by tens of kilobytes. diff then wraps,<br /> and "datalen = datalen + diff - msglen" yields a huge unsigned datalen,<br /> so the next iteration&amp;#39;s ct_sip_get_header() reads past the linearized skb<br /> tail.<br /> <br /> Widen diff, tdiff and the seq_adjust hook to s32. Both are bounded by the<br /> 65535 byte packet limit, and the seqadj core is already s32<br /> (nf_ct_seqadj_set() takes s32), so no previously accepted input is<br /> rejected.<br /> <br /> BUG: KASAN: use-after-free in ct_sip_get_header (net/netfilter/nf_conntrack_sip.c:464)<br /> Read of size 1 at addr ffff888010800000 by task ksoftirqd/1/25<br /> ct_sip_get_header (net/netfilter/nf_conntrack_sip.c:464)<br /> sip_help_tcp (net/netfilter/nf_conntrack_sip.c:1694)<br /> nf_confirm (net/netfilter/nf_conntrack_proto.c:183)<br /> nf_hook_slow (net/netfilter/core.c:619)<br /> ip6_output (net/ipv6/ip6_output.c:246)<br /> ip6_forward (net/ipv6/ip6_output.c:690)<br /> ipv6_rcv (net/ipv6/ip6_input.c:351)<br /> __netif_receive_skb_one_core (net/core/dev.c:6212)<br /> process_backlog (net/core/dev.c:6676)<br /> __napi_poll (net/core/dev.c:7735)<br /> net_rx_action (net/core/dev.c:7955)<br /> handle_softirqs (kernel/softirq.c:622)<br /> run_ksoftirqd (kernel/softirq.c:1076)<br /> ...