CVE-2026-72251netfilter: nf_nat_sip: reload possible stale data pointer
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_nat_sip: reload possible stale data pointer quoting sashiko: ------------------------------------------------------------------------ [..] noticed a potential memory bug and header corruption involving the SIP NAT helper. In net/netfilter/nf_nat_sip.c:nf_nat_sip(): if (skb_ensure_writable(skb, skb->len)) { nf_ct_helper_log(skb, ct, "cannot mangle packet"); return NF_DROP; } uh = (void *)skb->data + protoff; uh->dest = ct_sip_info->forced_dport; if (!nf_nat_mangle_udp_packet(skb, ct, ctinfo, protoff, 0, 0, NULL, 0)) { If a cloned or fragmented SKB is reallocated by skb_ensure_writable(), the old data buffer is freed. However, nf_nat_sip() fails to update *dptr to point to the new buffer. It also appears to use nf_nat_mangle_udp_packet() on what could be a TCP packet, which would overwrite the sequence number with a checksum update. ------------------------------------------------------------------------ nf_conntrack_sip linerizes skbs, hence no fragmented skb can be seen. But clones are possible, so rebuild dptr. Disable nf_nat_mangle_udp_packet() branch for TCP streams. It doesn't look like this can ever happen, else we should have received bug reports about this, so just check the conntrack is UDP and drop otherwise. The calling conntrack_sip set ->forced_dport for SIP_HDR_VIA_UDP messages, so I don't think this is ever expected to be true for a TCP stream.
- CVSS
- 9.8 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 7266507d89991fa1e989283e4e032c6d9357fe26 before bded21a4bf9bf86a79148be735723a97ca9a7532; from 7266507d89991fa1e989283e4e032c6d9357fe26 before dc11f26685aa850f237226f0f463647aea58ab7c; from 7266507d89991fa1e989283e4e032c6d9357fe26 before e38143c9b477f2968024c47c647dd4456a40aff1; 7266507d89991fa1e989283e4e032c6d9357fe26 builds before 57e4e29644ec054d7021d296407e7ddd844afea2; from 7266507d89991fa1e989283e4e032c6d9357fe26 before eae9c6ccb5af69c713a65f8ae219f5c1aa32cd17; 7266507d89991fa1e989283e4e032c6d9357fe26 builds before 2bcf2c5052fb5e73e255140ab43f056aef409c27; 7266507d89991fa1e989283e4e032c6d9357fe26 builds before 0e76e3e886cc9ee027337d5ad39cb96f57b7bdc7; 7266507d89991fa1e989283e4e032c6d9357fe26 builds before 77e43bcb7ec177e293a5c3f1b91a2c5aebfb6c68 | CNA record |
References
- https://git.kernel.org/stable/c/bded21a4bf9bf86a79148be735723a97ca9a7532
- https://git.kernel.org/stable/c/dc11f26685aa850f237226f0f463647aea58ab7c
- https://git.kernel.org/stable/c/e38143c9b477f2968024c47c647dd4456a40aff1
- https://git.kernel.org/stable/c/57e4e29644ec054d7021d296407e7ddd844afea2
- https://git.kernel.org/stable/c/eae9c6ccb5af69c713a65f8ae219f5c1aa32cd17
- https://git.kernel.org/stable/c/2bcf2c5052fb5e73e255140ab43f056aef409c27
- https://git.kernel.org/stable/c/0e76e3e886cc9ee027337d5ad39cb96f57b7bdc7
- https://git.kernel.org/stable/c/77e43bcb7ec177e293a5c3f1b91a2c5aebfb6c68
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.