The flaw is in the Linux kernel’s netfilter nf_conntrack_sip module, where the SIP Content-Length header is parsed with simple_strtoul() and the result is stored in an unsigned int. On 64‑bit systems, values larger than 32‑bit unsigned limits are silently truncated, leading the parser to miscompute message boundaries. An attacker can send a Content-Length value above 2^32, causing the module to treat trailing data as a second SIP message and forward it to the SDP parser. This misprocessing can exhaust resources or corrupt state, causing a denial of service or unpredictable SIP handling in applications that rely on the kernel. The weakness is an integer truncation (CWE‑681).

The issue is present in all Linux kernel builds that include the nf_conntrack_sip module and have not incorporated the upstream fix. No specific kernel version range is listed, so the vulnerability applies to all affected releases before the merge of the patch.

The vulnerability carries a CVSS score of 8.6, indicating high severity. EPSS indicates a very low but non‑zero exploitation probability (< 1 %). The flaw is not listed in the CISA KEV catalog. An attacker can exploit it over the network by sending crafted SIP packets containing an oversized Content-Length header. No local privileges are required and the attack path is straightforward, involving only the reception of malformed SIP traffic to a vulnerable kernel.