CVE-2026-23457

HIGH EPSS 29.4%

Published Apr 3, 20262mo ago · Modified Jun 17, 20261w ago

8.6 CVSS 3.1

High

Published Apr 3, 2026 2mo ago

Last Modified Jun 17, 2026 1w ago

Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() sip_help_tcp() parses the SIP Content-Length header with simple_strtoul(), which returns unsigned long, but stores the result in unsigned int clen. On 64-bit systems, values exceeding UINT_MAX are silently truncated before computing the SIP message boundary. For example, Content-Length 4294967328 (2^32 + 32) is truncated to 32, causing the parser to miscalculate where the current message ends. The loop then treats trailing data in the TCP segment as a second SIP message and processes it through the SDP parser. Fix this by changing clen to unsigned long to match the return type of simple_strtoul(), and reject Content-Length values that exceed the remaining TCP payload length.

CVSS Details

Base Score

8.6

Exploitability

3.9

Impact

4.7

Vector string

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

Attack Vector Network

Attack Complexity Low

Privileges Required None

User Interaction None

Scope Unchanged

Confidentiality Low

Integrity Low

Availability High

Threat Intelligence

EPSS Exploit Probability

29.4% percentile

Exploit & Patch Status

No Known Exploit

Patch Available

Affected Products 11

Vendor	Product	Version	Range
linux	linux_kernel	*	≥2.6.34 – <5.10.253
linux	linux_kernel	*	≥5.11 – <5.15.203
linux	linux_kernel	*	≥5.16 – <6.1.167
linux	linux_kernel	*	≥6.2 – <6.6.130
linux	linux_kernel	*	≥6.7 – <6.12.78
linux	linux_kernel	*	≥6.13 – <6.18.20
linux	linux_kernel	*	≥6.19 – <6.19.10
linux	linux_kernel	7.0	any
linux	linux_kernel	7.0	any
linux	linux_kernel	7.0	any
linux	linux_kernel	7.0	any

References 8

git.kernel.org https://git.kernel.org/stable/c/528b4509c9dfc272e2e92d811915e5211650d383

Patch
git.kernel.org https://git.kernel.org/stable/c/75fcaee5170e7dbbee778927134ef2e9568b4659

Patch
git.kernel.org https://git.kernel.org/stable/c/865dba58958c3a86786f89a501971ab0e3ec6ba9

Patch
git.kernel.org https://git.kernel.org/stable/c/b75209debb9adab287b3caa982f77788c1e15027

Patch
git.kernel.org https://git.kernel.org/stable/c/cd1b7403ec835f8a0b3f1f7e68ac26af2cb1e42f

Patch
git.kernel.org https://git.kernel.org/stable/c/d4f17256544cc37f6534a14a27a9dec3540c2015

Patch
git.kernel.org https://git.kernel.org/stable/c/ed81b6a7012485acdb9c6c80735a0b7d8e5e1873

Patch
git.kernel.org https://git.kernel.org/stable/c/fbce58e719a17aa215c724473fd5baaa4a8dc57c

Patch

Remediation

git.kernel.org https://git.kernel.org/stable/c/528b4509c9dfc272e2e92d811915e5211650d383

Patch
git.kernel.org https://git.kernel.org/stable/c/75fcaee5170e7dbbee778927134ef2e9568b4659

Patch
git.kernel.org https://git.kernel.org/stable/c/865dba58958c3a86786f89a501971ab0e3ec6ba9

Patch
git.kernel.org https://git.kernel.org/stable/c/b75209debb9adab287b3caa982f77788c1e15027

Patch
git.kernel.org https://git.kernel.org/stable/c/cd1b7403ec835f8a0b3f1f7e68ac26af2cb1e42f

Patch
git.kernel.org https://git.kernel.org/stable/c/d4f17256544cc37f6534a14a27a9dec3540c2015

Patch
git.kernel.org https://git.kernel.org/stable/c/ed81b6a7012485acdb9c6c80735a0b7d8e5e1873

Patch
git.kernel.org https://git.kernel.org/stable/c/fbce58e719a17aa215c724473fd5baaa4a8dc57c

Patch