CVE-2026-52986

What it actually does

This vulnerability affects the Linux kernel netfilter SIP connection-tracking and NAT helpers. The SIP parser previously used simple_strtoul() on packet-buffer data that is not guaranteed to be NUL-terminated and performed insufficient bounds checks after parsing SIP addresses. A malformed SIP message with a crafted port field at or near the end of the packet buffer can cause the kernel parser to read beyond the intended buffer or mis-handle invalid numeric values. The most likely impact is kernel-side denial of service or incorrect SIP conntrack/NAT parsing when nf_conntrack_sip or nf_nat_sip is enabled; available public information does not support assuming reliable remote code execution.

Why it matters to the business

Systems that inspect or NAT SIP traffic at the kernel firewall layer may be exposed to remote crashes or service disruption from malformed network traffic. Impact is highest for VoIP gateways, SIP border devices, firewalls, routers, Kubernetes/container hosts, and Linux servers that load SIP conntrack helpers. The vulnerability is not currently listed in CISA KEV, has low EPSS, is not known to be used in ransomware campaigns, and has no public exploit maturity reported, so urgency is lower than actively exploited kernel bugs but still important for internet-facing SIP infrastructure.

How an attack unfolds

An attacker first identifies a Linux host or gateway that processes SIP traffic through netfilter connection tracking, typically on UDP or TCP SIP ports such as 5060 or 5061, or through firewall/NAT rules that invoke the SIP helper. The attacker sends a specially malformed SIP request or header containing a URI or numeric parameter with an invalid or boundary-aligned port value. When the vulnerable nf_conntrack_sip parser inspects the packet, it may parse beyond the packet buffer because the old logic expected NUL-terminated strings and did not consistently validate each digit against the buffer limit. If the bad parse reaches vulnerable code paths, the kernel may reject traffic incorrectly, create incorrect conntrack/NAT state, or fault, potentially disrupting packet forwarding or the host itself. There is no current evidence of broad exploitation, named threat-actor use, or ransomware use for this issue.

How to fix it

Apply the Linux kernel update provided by the operating system or appliance vendor that includes the nf_conntrack_sip parsing fix replacing unsafe simple_strtoul() usage with bounded SIP port parsing. Because no exact fixed package versions were provided, use the vendor advisory for the deployed distribution, cloud image, network appliance, or embedded platform to identify the corrected kernel build. Reboot into the updated kernel after installation, or live-patch only if the vendor explicitly supplies a live patch for this kernel networking code. If immediate patching is not possible, reduce exposure by disabling automatic conntrack helpers where feasible, removing or avoiding nf_conntrack_sip and nf_nat_sip helper use, restricting SIP traffic to trusted peers, blocking unsolicited SIP traffic at the perimeter, and rate-limiting malformed SIP packets. Validate that changes do not break legitimate VoIP/NAT traversal before broad deployment.

How to confirm the fix worked

Confirm the running kernel is the vendor-fixed build, not merely that the package is installed. Check loaded modules and rules to determine whether the SIP helper is in use, for example by reviewing loaded kernel modules for nf_conntrack_sip or nf_nat_sip and inspecting firewall/nftables/iptables helper assignments. On source-based or custom kernels, verify the vulnerable simple_strtoul() parsing has been removed from net/netfilter/nf_conntrack_sip.c and related conntrack SIP parsing paths. In a controlled lab, send malformed SIP packets with invalid, overlong, or buffer-ending port values and confirm the host remains stable, logs no kernel faults, and handles or rejects packets cleanly. Monitor dmesg, journalctl -k, crash dumps, and network telemetry after deployment to confirm there are no recurring SIP-helper-related kernel warnings or panics.

Typical attack path

1. Find a Linux system, firewall, gateway, or NAT device that handles SIP traffic and has the netfilter SIP conntrack/NAT helper enabled or auto-loaded.
2. Send SIP traffic to a parsed SIP service path, commonly UDP/TCP 5060 or 5061, or another port covered by firewall helper rules.
3. Craft SIP request lines, headers, or URI fields where the address contains a malformed port value, an excessively long digit sequence, or a port value that reaches the end of the packet buffer without a valid trailing delimiter.
4. Trigger vulnerable parsing in nf_conntrack_sip or nf_nat_sip as the kernel inspects the packet for connection tracking or NAT rewriting.
5. Cause malformed parsing, conntrack/NAT disruption, or a possible kernel fault leading to denial of service.

How to detect it

Evidence of exploitation may be limited because the vulnerable code runs in the kernel packet path and malformed packets may not reach application logs. Review network packet captures, firewall logs, IDS events, and NetFlow around SIP traffic, especially UDP/TCP 5060 and 5061, for malformed SIP URIs or headers with port fields that are empty, extremely long, non-decimal, greater than valid port ranges, or terminate abruptly at packet end. Review kernel logs via dmesg, journalctl -k, syslog, kmsg, and crash dump systems for oops, panic, general protection fault, slab, skb, netfilter, nf_conntrack_sip, or nf_nat_sip messages correlated with SIP traffic. If available, inspect firewall helper logs, nftables/iptables counters, conntrack event logs, and IDS alerts for bursts of malformed SIP requests from the same source. Because there are no known public exploitation campaigns or actor-specific indicators, detection should focus on anomalous malformed SIP parsing attempts and unexplained kernel instability on systems with the SIP helper enabled.

• nf_conntrack_sip
• nf_nat_sip
• net/netfilter/nf_conntrack_sip.c
• net/netfilter/nf_nat_sip.c
• simple_strtoul
• sip:10.0.0.1:005060
• UDP/5060 malformed SIP URI port
• TCP/5060 malformed SIP URI port
• UDP/5061 malformed SIP URI port
• TCP/5061 malformed SIP URI port
• SIP URI port with overlong digit sequence
• SIP URI port reaches end of packet
• kernel: nf_conntrack_sip
• kernel: nf_nat_sip
• general protection fault
• BUG: kernel NULL pointer dereference
• skb_over_panic
• nf_conntrack:
• SIP/2.0

What your security team should do

• Inventory Linux systems, firewalls, routers, SBC-adjacent hosts, NAT gateways, and appliances that process SIP traffic or load nf_conntrack_sip/nf_nat_sip.
• Prioritize patching internet-facing or untrusted-network-facing systems that inspect, forward, or NAT SIP traffic.
• If patching is delayed, disable SIP conntrack/NAT helpers where operationally acceptable and restrict SIP traffic to known providers, trunks, proxies, or VPN paths.
• Add IDS/SIEM monitoring for malformed SIP messages with invalid or unusually long port fields, especially on UDP/TCP 5060 and 5061.
• Review kernel logs and crash telemetry for signs of netfilter, conntrack, SIP helper, or skb parsing faults since exposure began.
• Coordinate VoIP testing after mitigation because disabling SIP helpers can affect NAT traversal and dynamic media pinhole behavior.
• Track vendor kernel advisories because fixed versions vary by distribution, appliance, and backported kernel branch.