CVE-2026-31427

A flaw was found in the Linux kernel's netfilter subsystem, specifically within the nf_conntrack_sip module. This vulnerability occurs in the process_sdp function when the rtp_addr variable is used without proper initialization if the Session Description Protocol (SDP) body lacks recognized media types or active media sections. A remote attacker could potentially exploit this by sending specially crafted SDP messages, leading to the rewriting of session-level owner and connection addresses with uninitialized or stale stack values. This could result in information disclosure or unexpected network behavior, potentially causing a denial of service.

The bug is confined to SIP sessions handled by the connection-tracking helper and NAT SDP hooks. It requires SIP traffic traversing a host with nf_conntrack_sip (and relevant NAT) loaded. Integrity of signaling is affected; remote attackers who can pass SDP through the helper can influence rewritten addresses. Scope should be reviewed against whether IPv4/IPv6 SIP transit applies (network vs. strictly local control plane).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the nf_conntrack_sip module from being loaded when SIP helper/NAT is not required. See https://access.redhat.com/solutions/41278 for instructions.