CVE-2026-53002: Linux kernel netfilter conntrack out-of-bounds write in SIP helper
A fixed Linux kernel flaw in netfilter conntrack allows an out-of-bounds write (CWE-787) during SIP helper processing of SDP content used for NAT, as reported by KASAN. The CNA scores it 9.8 (Critical) with CVSS 3.1, and the record links eight stable-branch patches. No confirmed active exploitation appears in the sources consulted, and it is not listed in CISA KEV.
Overview
The fix for this CVE in the Linux kernel replaces a sprintf call in netfilter conntrack with scnprintf and enlarges a buffer in mangle_content_len(). The commit text states that the buffers are expected to be large enough for the result. The KASAN report quoted in the record describes a stack out-of-bounds write reached through SIP INVITE processing and SDP session NAT handling. See the NVD entry and the CVE Record.
Impact
- The record classifies the weakness as CWE-787 (Out-of-bounds Write).
- The CNA CVSS 3.1 score is 9.8 (Critical) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which describes a network-reachable issue requiring no privileges and no user interaction, with high confidentiality, integrity and availability impact.
- A second scoring provider in the record lists a CVSS 3.1 score of 7.
- The sources do not describe the concrete consequence beyond the memory-safety finding, so the practical outcome in a given deployment is unknown.
Affected products and versions
The record lists the following Linux kernel ranges: from 2.6.20 before 5.10.258; from 5.11 before 5.15.209; from 5.16 before 6.1.175; from 6.2 before 6.6.141; from 6.7 before 6.12.91; from 6.13 before 6.18.33; and from 6.19 before 7.0.10.
The record also lists Red Hat Enterprise Linux entries for versions 7.0, 8.0, 9.0 and 10.0. The record does not state which specific RHEL package builds are affected or fixed, so administrators should check the linked Red Hat errata and the Red Hat CVE page for the exact build status.
Exploitation status
The record shows that this CVE is not listed in the CISA KEV catalog. No confirmed exploitation in the wild appears in the sources consulted for this analysis.
Remediation and mitigation
- Apply the kernel update from your distribution or the stable branch that contains the upstream fix. The record links the upstream commits, for example commit a8e0a32a.
- For Red Hat systems, review the errata referenced in the record and apply the one matching your release.
- Where patching is delayed, reduce exposure by limiting the use of the affected netfilter SIP connection-tracking helper to systems that need it, as a general defensive measure. The record does not describe a specific vendor-approved workaround, so this is an inference, not a documented mitigation.
Detection guidance
- Track kernel package versions against the ranges above and flag hosts that run older builds.
- Monitor kernel and system logs for memory-safety reports such as KASAN warnings on hosts that run netfilter SIP handling. The record shows such a report, but it does not define a reliable indicator of compromise.
- Review perimeter and NAT devices running Linux for unexpected SIP traffic handled by connection-tracking helpers.
Limitations of the available information
- The record gives no public proof-of-concept details, no exploitation timeline and no CVSS-based exploitability metric beyond the vector string.
- The EPSS value and SSVC data are not available in the record, so exploitation likelihood is unknown.
- The provider behind the second CVSS score of 7 is not named in the record.
- Whether a given distribution build contains the fix depends on its packaging, which the record does not fully document.
Frequently asked questions
What is the core problem in this CVE?
The record describes a stack out-of-bounds write in the Linux kernel netfilter conntrack code, reached through SIP and SDP processing used for NAT. The upstream fix replaces sprintf with scnprintf and enlarges a buffer.
How severe is it according to the record?
The CNA assigns CVSS 3.1 9.8 (Critical) with a network attack vector and no privileges or user interaction required. A second provider in the record lists a CVSS 3.1 score of 7.
Is this CVE known to be actively exploited?
No. The record shows it is not in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.
What should administrators do first?
Check kernel and RHEL package versions against the affected ranges in the record and apply the vendor update that contains the upstream fix. Where patching is delayed, limit use of the SIP connection-tracking helper to systems that need it.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.