CVE-2026-100070

A flaw was found in the Linux kernel. This vulnerability can result in information disclosure when processing Session Initiation Protocol (SIP) traffic through the netfilter Network Address Translation (NAT) helper. When address rewriting shortens a packet, the helper fails to adjust its internal offset, causing subsequent Contact headers to be skipped during translation. Consequently, an external recipient or network observer may receive untranslated internal IP addresses, exposing private network details.

Red Hat rates this flaw as moderate. It is an information disclosure issue in the Linux kernel's netfilter SIP NAT helper (nf_nat_sip), affecting the kernel packages in Red Hat Enterprise Linux, Red Hat In-Vehicle OS, and the Red Hat Enterprise Linux CoreOS layers of Red Hat OpenShift Container Platform. When the helper rewrites addresses in Session Initiation Protocol (SIP) packets and the public NAT address string is shorter than the internal address it replaces, the packet shrinks but the helper's internal parsing offset is not adjusted. The stale offset can cause a subsequent Contact header to be skipped during translation, so the packet is sent with an untranslated internal IP address. A remote attacker or network observer who can cause a NATed SIP message containing multiple Contact headers to be processed could use this to learn internal network addresses or topology. The flaw does not involve memory corruption, privilege escalation, or denial of service. Exploitation requires the non-default SIP connection tracking/NAT helper to be enabled and active, a NAT configuration in which address rewriting shortens the packet, and SIP messages containing multiple Contact headers. Red Hat Enterprise Linux 6 is not affected because the vulnerable code is not present in that release. Fixes for the affected products are currently deferred to a future update; the residual risk is limited to disclosure of internal network addressing on systems that pass SIP traffic through the netfilter SIP NAT helper.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

The vulnerable code path is only reachable when the SIP connection tracking/NAT helper is enabled, which is not the default configuration. On systems where the SIP NAT helper has been explicitly enabled, disabling it (for example, by unloading or preventing the loading of the nf_conntrack_sip and nf_nat_sip kernel modules, or by disabling automatic conntrack helper assignment for SIP traffic) prevents netfilter from rewriting SIP payloads and thereby prevents untranslated Contact headers from being sent to external recipients. Note that disabling the helper also disables SIP application-level gateway (ALG) processing, which may affect SIP deployments that rely on it, so the operational impact should be evaluated before applying this change.