CVE-2026-98077

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf conntrack sip: fix OOB read in sip skip whitespace()

sip skip whitespace() returns dptr unchanged when its own loop exhausts the buffer (dptr == limit), instead of NULL like its sibling sip follow continuation() returns on its own "no more data" path.

ct sip get header() only checks for NULL after calling it:

dptr = sip skip whitespace(dptr, limit); if (dptr == NULL) break; if (*dptr != ':' || ++dptr >= limit) break;

so a recognized header name followed only by spaces/tabs running to the exact end of the SIP payload, with no colon, makes the very next statement read one byte past the buffer.

Make both "no more data" outcomes return NULL, matching the convention sip follow continuation() already uses and that both existing callers already check for.