The vulnerability lies in the SIP Content-Length header parsing logic within the Linux kernel’s netfilter connection tracking module. The parser converts the header value using an unsigned long return type but stores it in an unsigned int. On 64‑bit systems, values larger than the maximum 32‑bit unsigned int are silently truncated, which causes the module to miscalculate the true end of the SIP message. As a result, trailing data in the TCP segment is interpreted as a second SIP message and passed to the SDP parser. The impact is that an attacker can send crafted SIP traffic that may be mishandled, potentially leading to denial of service or unexpected behavior within applications that rely on SIP parsing.

The flaw is present in the Linux kernel’s netfilter nf_conntrack_sip implementation. All Linux kernel builds that include this module and have not applied the upstream patch are susceptible. No specific kernel version range was listed, so the risk applies to all affected releases before the fix was merged.

This is an integer truncation weakness categorized as CWE‑681. The CVSS score of 7.0 indicates a high severity. An attacker can exploit this by sending large Content‑Length values over TCP to a target running the vulnerable kernel. The attack vector is network‑based and does not require privileged access. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that while exploitability is feasible, it may be less frequently observed in the wild.