The nf_conntrack_sip helper in the Linux kernel assumes that the packet’s routing information, accessed via skb_dst(), is present when the sip_external_media module parameter is set to 1. However, subsystems such as traffic‑control ingress and Open vSwitch do not guarantee that routing data is available. Without a guard check, the helper preemptively disables the external media capability instead of correctly processing the packet. This results in a loss of functionality for SIP traffic that relies on external media support, effectively creating a denial of service to that feature without crashing the system.

All Linux kernel releases that include the nf_conntrack_sip helper without the upstream validation patch are affected. The vendor is Linux and the product is the Linux kernel. Because no specific kernel version range is provided, every kernel that lacks the patch should be considered vulnerable. The issue manifests in configurations where sip_external_media is enabled for traffic that traverses subsystems that may not supply routing context, notably traffic‑control ingress and Open vSwitch.

The CVSS score of 7.5 categorizes the issue as high severity, but the EPSS <1% and absence from CISA’s KEV listing suggest that exploitation is unlikely to be widespread. An attacker could trigger the problem by sending SIP packets that activate the helper on a system using tc ingress or Open vSwitch where routing information is missing. Because the flaw only disables a functionality rather than crashing the kernel, the impact is limited to the loss of SIP external media support.