In Linux kernels, the nf_conntrack_sip helper previously parsed SIP port numbers using simple_strtoul, a routine that assumes NUL‑terminated input and performs no bounds checking on data extracted from network buffers. This caused out‑of‑bounds reads and potential NULL pointer dereferences when processing malformed SIP packets. The patch replaces those calls with a stricter parsing routine that validates each digit against the buffer limit, enforces UINT_MAX bounds, rejects excessively long sequences, and ensures that numeric parameters are parsed in base‑10. By preventing these memory corruption bugs, the kernel no longer risks a service‑disruption condition caused by crafted SIP traffic.

The vulnerability exists in the nf_conntrack_sip helper present in all Linux kernel versions that include the unpatched parsing code. The affected products are generic Linux kernels; specific version ranges are not enumerated in the available data, but any kernel incorporating this module before the patch is potentially impacted. Updates that include the new sip_parse_port() helper are required to remediate the issue.

The CVSS score of 9.8 classifies this incident as critical, and the absence of a known exploitation record (KEV: not listed) combined with an EPSS of <1% suggests that widespread attacks are not yet observed. Nevertheless, any host receiving crafted SIP packets can experience a denial‑of‑service by exhausting kernel memory or triggering a crash, so the risk remains high for exposed services that handle SIP traffic.