{"id":8868,"date":"2026-09-04T18:50:06","date_gmt":"2026-09-04T10:50:06","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-74569-2"},"modified":"2026-09-04T18:50:06","modified_gmt":"2026-09-04T10:50:06","slug":"cve-2026-74569-2","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-74569-2","title":{"rendered":"CVE-2026-74569 [CRITICAL] &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_conntra"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp()<\/p>\n<p>sip_help_tcp() stores the size change of each NAT-rewritten SIP message<br \/>\nin s16 diff and accumulates it in s16 tdiff, but a single message can<br \/>\ngrow by more than S16_MAX while the packet stays under the 65535<br \/>\nenlarge_skb() limit: nf_nat_sip() rewrites every matching URI, and a long<br \/>\nContact list expands the message by tens of kilobytes. diff then wraps,<br \/>\nand &#8220;datalen = datalen + diff &#8211; msglen&#8221; yields a huge unsigned datalen,<br \/>\nso the next iteration&#8217;s ct_sip_get_header() reads past the linearized skb<br \/>\ntail.<\/p>\n<p>Widen diff, tdiff and the seq_adjust hook to s32. Both are bounded by the<br \/>\n65535 byte packet limit, and the seqadj core is already s32<br \/>\n(nf_ct_seqadj_set() takes s32), so no previously accepted input is<br \/>\nrejected.<\/p>\n<p>  BUG: KASAN: use-after-free in ct_sip_get_header (net\/netfilter\/nf_conntrack_sip.c:464)<br \/>\n  Read of size 1 at addr ffff888010800000 by task ksoftirqd\/1\/25<br \/>\n   ct_sip_get_header (net\/netfilter\/nf_conntrack_sip.c:464)<br \/>\n   sip_help_tcp (net\/netfilter\/nf_conntrack_sip.c:1694)<br \/>\n   nf_confirm (net\/netfilter\/nf_conntrack_proto.c:183)<br \/>\n   nf_hook_slow (net\/netfilter\/core.c:619)<br \/>\n   ip6_output (net\/ipv6\/ip6_output.c:246)<br \/>\n   ip6_forward (net\/ipv6\/ip6_output.c:690)<br \/>\n   ipv6_rcv (net\/ipv6\/ip6_input.c:351)<br \/>\n   __netif_receive_skb_one_core (net\/core\/dev.c:6212)<br \/>\n   process_backlog (net\/core\/dev.c:6676)<br \/>\n   __napi_poll (net\/core\/dev.c:7735)<br \/>\n   net_rx_action (net\/core\/dev.c:7955)<br \/>\n   handle_softirqs (kernel\/softirq.c:622)<br \/>\n   run_ksoftirqd (kernel\/softirq.c:1076)<br \/>\n   &#8230;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp()<\/p>\n<p>sip_help_tcp() stores the size change of each NAT-re<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-8868","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/8868","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=8868"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=8868"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=8868"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}