The Linux kernel’s nf_conntrack_sip module parses the SIP Content‑Length header using simple_strtoul(), which returns an unsigned long, but stores the value in an unsigned int. On 64‑bit systems this silently truncates numbers that exceed the 32‑bit unsigned maximum. When a Content‑Length value such as 2^32+32 is truncated to 32, the kernel miscalculates the end of the SIP message. The parser then treats the remaining data in the TCP segment as a second SIP message and forwards it to the SDP parser, potentially corrupting state or exhausting resources, resulting in a denial of service or unpredictable application behavior. Based on the description, it is inferred that an attacker can craft SIP packets with oversized Content‑Length headers, sending them over the network to a vulnerable kernel. This attack does not require local privileges and relies solely on malformed SIP traffic to trigger the bug. The flaw is an integer truncation error (CWE‑681) that directly impacts the integrity of SIP message parsing. The kernel does not perform validation against the remaining TCP payload, which allows the attacker to manipulate the parsing boundary arbitrarily.

All Linux kernel releases that include the nf_conntrack_sip module and have not applied the upstream fix are affected. The kernel version list provided (complete e.g., 7.0 releases and earlier) indicates that the vulnerability exists across multiple generations of the kernel until the patch is merged. No specific software vendor or distribution is enumerated beyond the generic Linux kernel. This includes systems running on 64‑bit architectures, as the truncation occurs only on those platforms. No version ranges are supplied in the CNA data, so the recommendation is that any kernel build that incorporates nf_conntrack_sip and predates the merged patch is potentially vulnerable.

The CVSS score of 8.6 demonstrates high severity, while the EPSS score of < 1% indicates a very low but non-zero probability that the vulnerability will see real‑world exploitation. The flaw is not listed in the CISA KEV catalog. Attackers could exploit the issue remotely, simply by sending specially crafted SIP traffic to a vulnerable host. No user interaction or local privileges are needed, and the exploitation path is straightforward: receive malicious SIP packets containing an oversized Content‑Length header and trigger the integer truncation bug which in turn leads to denial of service or application corruption.