CVE-2026-74569

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the netfilter module where the sip help tcp() function uses signed 16-bit integers (s16) for the diff and tdiff variables to track size changes in NAT-rewritten SIP messages. Because a single message with a long Contact list can expand by more than the maximum value of a signed 16-bit integer while remaining under the 65535 byte packet limit, an integer wrap occurs. This leads to an incorrect calculation of datalen, causing the ct sip get header() function to read memory past the linearized skb tail, resulting in a use-after-free condition.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.