CVE-2026-23457

A flaw was found in the Linux kernel's netfilter subsystem, specifically within the nf_conntrack_sip module. This vulnerability arises from an integer truncation error when processing the Content-Length header in Session Initiation Protocol (SIP) messages. On 64-bit systems, large Content-Length values are silently truncated, causing the system to misinterpret the boundary of SIP messages. This can lead to the incorrect parsing of network traffic, potentially allowing an attacker to bypass security policies or trigger unintended processing of data.

Truncating Content-Length to 32 bits mis-positions SIP message boundaries so trailing bytes may be parsed as a second message through SDP handling. Requires SIP traffic through the conntrack helper; the effect is parser confusion and possible policy bypass, not a classic buffer overflow.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the nf_conntrack_sip module from being loaded. See https://access.redhat.com/solutions/41278 for instructions.