The vulnerability exists in the Linux kernel's netfilter nf_nat_sip module, where a pointer offset is incorrectly handled after NAT shrinks the packet. When the packet length changes due to a shorter public IP string, the offset calculation can overshoot, causing the packet parsing routine to skip over subsequent Contact headers. This flow defect may cause those headers to be left unaltered, allowing an attacker to see internal network addresses that should have been NATed away. The effect is a loss of confidentiality for SIP traffic flowing through the affected NAT.

The flaw affects Linux kernel installations that include the netfilter nf_nat_sip component, which is present in all mainstream Linux distributions employing the standard kernel. No specific kernel release versions or vendor‑specific branches are listed, so any system running a traditional Linux kernel with the nf_nat_sip module is potentially impacted.

Because the flaw manifests when a SIP packet undergoes NAT that shortens its payload, an attacker can trigger it by sending crafted SIP traffic to the affected host from the internet. Success depends on network traffic patterns and the presence of a SIP server behind the NAT. The exploitation does not require authentication or privileged access; it can be performed over inbound connections. The CVSS score of 5.5 indicates moderate severity, and the EPSS score of <1% shows a low probability of exploitation in the wild. The vulnerability is not listed in CISA's KEV catalog, indicating limited evidence of exploitation in the wild. Nevertheless, the potential for internal network detail leakage warrants attention, especially in environments handling sensitive SIP communications.