CVE-2026-98077

A flaw was found in the Linux kernel's Session Initiation Protocol (SIP) netfilter connection tracking module. When processing incoming SIP headers, the parser fails to properly detect the end of the network packet buffer when trailing whitespace is present without a header delimiter, resulting in an out-of-bounds read. A remote attacker could exploit this issue by sending specially crafted SIP packets, which may lead to a Denial of Service (DoS) through a system crash or result in limited information disclosure.

An out of bounds read in the netfilter SIP connection tracking helper occurs because sip_skip_whitespace can return a pointer equal to the payload limit instead of NULL. A remote sender can reach the invalid read by supplying a recognized SIP header name followed only by spaces or tabs up to the exact end of the packet payload without a colon. For the CVSS the PR:N value is used because no account or local execution context is required when crafted SIP traffic can reach a system where the nf_conntrack_sip helper is active. The issue is network reachable but practical exposure depends on SIP connection tracking being loaded and assigned to the relevant traffic. The direct primitive is a one byte out of bounds read rather than memory corruption. Impact is normally limited to incorrect parsing or availability degradation, while an unfavorable buffer placement may cause a kernel fault and denial of service. There is no supported write primitive or credible privilege escalation path.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.