CVE-2026-31427 - Vulnerability Details

- netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp

Description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp

process_sdp() declares union nf_inet_addr rtp_addr on the stack and
passes it to the nf_nat_sip sdp_session hook after walking the SDP
media descriptions. However rtp_addr is only initialized inside the
media loop when a recognized media type with a non-zero port is found.

If the SDP body contains no m= lines, only inactive media sections
(m=audio 0 ...) or only unrecognized media types, rtp_addr is never
assigned. Despite that, the function still calls hooks->sdp_session()
with &rtp_addr, causing nf_nat_sdp_session() to format the stale stack
value as an IP address and rewrite the SDP session owner and connection
lines with it.

With CONFIG_INIT_STACK_ALL_ZERO (default on most distributions) this
results in the session-level o= and c= addresses being rewritten to
0.0.0.0 for inactive SDP sessions. Without stack auto-init the
rewritten address is whatever happened to be on the stack.

Fix this by pre-initializing rtp_addr from the session-level connection
address (caddr) when available, and tracking via a have_rtp_addr flag
whether any valid address was established. Skip the sdp_session hook
entirely when no valid address exists.

Published: 2026-04-13

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The uninitialized stack variable rtp_addr in the Linux kernel’s netfilter nf_conntrack_sip module causes nf_nat_sip to format a stale stack value into an IP address and rewrite the session owner and connection lines of SIP messages with it. The result is that SIP sessions may be incorrectly configured with 0.0.0.0 or a garbage address, leading to connectivity failures, misrouting of media streams, or a denial of service to SIP clients.

Affected Systems

All Linux kernel distributions that include the netfilter nf_conntrack_sip code before the recent commit are affected. The vulnerability applies to the Linux kernel itself, regardless of specific vendor, and affects any systems that employ SIP NAT functionality via nf_conntrack_sip. Version details are not explicitly listed, so any kernel that has not applied the patch is potentially vulnerable.

Risk and Exploitability

The CVSS score of 5.5 indicates moderate severity. The EPSS score of 0.00035 implies a very low probability of exploitation, though it is not zero. This vulnerability can be exploited by an attacker who can send crafted SIP packets to a node running the vulnerable kernel, causing the kernel to rewrite session addresses incorrectly. This makes a network‑oriented exploitation likely if the system processes SIP traffic, but active exploitation has not been reported. The vulnerability is not listed in the CISA KEV catalog.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`4ab9e64e5e3c0516577818804aaf13a630d67bc9`	affected	< faa6ea32797a1847790514ff0da1be1d09771580
`4ab9e64e5e3c0516577818804aaf13a630d67bc9`	affected	< 82baeb871e8f04906bc886273fdf0209e1754eb3
`4ab9e64e5e3c0516577818804aaf13a630d67bc9`	affected	< 6e5e3c87b7e6212f1d8414fc2e4d158b01e12025
`4ab9e64e5e3c0516577818804aaf13a630d67bc9`	affected	< fe463e76c9b4b0b43b5ee8961b4c500231f1a3f6
`4ab9e64e5e3c0516577818804aaf13a630d67bc9`	affected	< 7edca70751b9bdb5b83eed53cde21eccf3c86147
`4ab9e64e5e3c0516577818804aaf13a630d67bc9`	affected	< 01f34a80ac23ae90b1909b94b4ed05343a62f646
`4ab9e64e5e3c0516577818804aaf13a630d67bc9`	affected	< 52fdda318ef2362fc5936385bcb8b3d0328ee629
`4ab9e64e5e3c0516577818804aaf13a630d67bc9`	affected	< 6a2b724460cb67caed500c508c2ae5cf012e4db4

Linux

affected

Version	Status	Constraints
`2.6.26`	affected	—
`0`	unaffected	< 2.6.26
`5.10.253`	unaffected	≤ 5.10.*
`5.15.203`	unaffected	≤ 5.15.*
`6.1.168`	unaffected	≤ 6.1.*
`6.6.131`	unaffected	≤ 6.6.*
`6.12.80`	unaffected	≤ 6.12.*
`6.18.21`	unaffected	≤ 6.18.*
`6.19.11`	unaffected	≤ 6.19.*
`7.0`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc1::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc2::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc3::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc4::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc5::::::

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[4ab9e64e5e3c0516577818804aaf13a630d67bc9,6e5e3c87b7e6212f1d8414fc2e4d158b01e12025)`	affected	code_commit	—
`[4ab9e64e5e3c0516577818804aaf13a630d67bc9,fe463e76c9b4b0b43b5ee8961b4c500231f1a3f6)`	affected	code_commit	—
`[4ab9e64e5e3c0516577818804aaf13a630d67bc9,7edca70751b9bdb5b83eed53cde21eccf3c86147)`	affected	code_commit	—
`[4ab9e64e5e3c0516577818804aaf13a630d67bc9,01f34a80ac23ae90b1909b94b4ed05343a62f646)`	affected	code_commit	—
`[4ab9e64e5e3c0516577818804aaf13a630d67bc9,52fdda318ef2362fc5936385bcb8b3d0328ee629)`	affected	code_commit	—
`[4ab9e64e5e3c0516577818804aaf13a630d67bc9,6a2b724460cb67caed500c508c2ae5cf012e4db4)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`2.6.26`	affected	semver	—
`[0,2.6.26)`	unaffected	semver	—
`[6.1.168,6.2.0)`	unaffected	semver	—
`[6.6.131,6.7.0)`	unaffected	semver	—
`[6.12.80,6.13.0)`	unaffected	semver	—
`[6.18.21,6.19.0)`	unaffected	semver	—
`[6.19.11,6.20.0)`	unaffected	semver	—
`[7.0,*]`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version that contains the fix for the nf_conntrack_sip uninitialized rtp_addr bug.
If a kernel upgrade is not immediately possible, disable or unload the nf_nat_sip module or SIP NAT functionality in netfilter until a patched kernel is deployed.
Verify that the system’s netfilter configuration does not enable the nf_nat_sip module and monitor for anomalous SIP traffic containing 0.0.0.0 addresses.

Generated by OpenCVE AI on May 20, 2026 at 20:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4561-1	linux-6.1 security update
Debian DSA	DSA-6238-1	linux security update
Debian DSA	DSA-6243-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00035.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/01f34a80ac23ae90b1909b94b4ed05343a62f646
https://git.kernel.org/stable/c/52fdda318ef2362fc5936385bcb8b3d0328ee629
https://git.kernel.org/stable/c/6a2b724460cb67caed500c508c2ae5cf012e4db4
https://git.kernel.org/stable/c/6e5e3c87b7e6212f1d8414fc2e4d158b01e12025
https://git.kernel.org/stable/c/7edca70751b9bdb5b83eed53cde21eccf3c86147
https://git.kernel.org/stable/c/82baeb871e8f04906bc886273fdf0209e1754eb3
https://git.kernel.org/stable/c/faa6ea32797a1847790514ff0da1be1d09771580
https://git.kernel.org/stable/c/fe463e76c9b4b0b43b5ee8961b4c500231f1a3f6
https://lore.kernel.org/linux-cve-announce/2026041357-CVE-2026-31427-1afe@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-31427
https://www.cve.org/CVERecord?id=CVE-2026-31427

History

Wed, 20 May 2026 19:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-908
CPEs		cpe:2.3:o:linux:linux_kernel:7.0:rc1:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc2:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc3:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc4:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc5::::::
Metrics	cvssV3_1 `{'score': 5.8, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H'}`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}`

Sat, 18 Apr 2026 09:15:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/82baeb871e8f04906bc886273fdf0209e1754eb3 https://git.kernel.org/stable/c/faa6ea32797a1847790514ff0da1be1d09771580

Tue, 14 Apr 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-824
References		https://lore.kernel.org/linux-cve-announce/2026041357-CVE-2026-31427-1afe@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-31427 https://www.cve.org/CVERecord?id=CVE-2026-31427
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.8, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H'}` threat_severity `Moderate`

Mon, 13 Apr 2026 13:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp process_sdp() declares union nf_inet_addr rtp_addr on the stack and passes it to the nf_nat_sip sdp_session hook after walking the SDP media descriptions. However rtp_addr is only initialized inside the media loop when a recognized media type with a non-zero port is found. If the SDP body contains no m= lines, only inactive media sections (m=audio 0 ...) or only unrecognized media types, rtp_addr is never assigned. Despite that, the function still calls hooks->sdp_session() with &rtp_addr, causing nf_nat_sdp_session() to format the stale stack value as an IP address and rewrite the SDP session owner and connection lines with it. With CONFIG_INIT_STACK_ALL_ZERO (default on most distributions) this results in the session-level o= and c= addresses being rewritten to 0.0.0.0 for inactive SDP sessions. Without stack auto-init the rewritten address is whatever happened to be on the stack. Fix this by pre-initializing rtp_addr from the session-level connection address (caddr) when available, and tracking via a have_rtp_addr flag whether any valid address was established. Skip the sdp_session hook entirely when no valid address exists.
Title		netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/01f34a80ac23ae90b1909b94b4ed05343a62f646 https://git.kernel.org/stable/c/52fdda318ef2362fc5936385bcb8b3d0328ee629 https://git.kernel.org/stable/c/6a2b724460cb67caed500c508c2ae5cf012e4db4 https://git.kernel.org/stable/c/6e5e3c87b7e6212f1d8414fc2e4d158b01e12025 https://git.kernel.org/stable/c/7edca70751b9bdb5b83eed53cde21eccf3c86147 https://git.kernel.org/stable/c/fe463e76c9b4b0b43b5ee8961b4c500231f1a3f6

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-04-13T13:40:30.280Z

Updated: 2026-05-11T22:08:29.865Z

Reserved: 2026-03-09T15:48:24.088Z

Link: CVE-2026-31427

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2026-04-13T14:16:12.783

Modified: 2026-05-20T19:27:17.860

Link: CVE-2026-31427

Redhat

Severity : Moderate

Publid Date: 2026-04-13T00:00:00Z

Links: CVE-2026-31427 - Bugzilla

OpenCVE Enrichment

Updated: 2026-05-20T21:00:12Z

Weaknesses

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object