The nf_conntrack SIP module in the Linux kernel can overflow a 16‑bit counter that records the size change of each NAT‑rewritten SIP message. When a message contains a very large Contact list, the counter wraps, leading to an inflated length calculation that causes packet parsing to read past the linearized skb tail. The bug manifests as a use‑after‑free in ct_sip_get_header, potentially crashing the kernel or allowing an attacker to execute arbitrary code with kernel privileges. This represents an integer‑overflow‑induced memory corruption flaw.

Any Linux system running a kernel that includes the nf_conntrack SIP module before the commit that applies the patch (commit 63eea41759fd682229c14e0a2205802b46d106f3). No explicit vendor version range is given, so all kernel releases lacking this patch are potentially vulnerable until the update is applied.

The EPSS score is < 1%, indicating a very low probability of exploitation, and the vulnerability is not listed in CISA KEV. The CVSS score of 9.8 reflects a critical severity, underscoring the high potential for denial of service or privilege escalation through kernel memory corruption. Despite the low exploitation likelihood, the flaw touches kernel memory and carries a high risk of denial of service or privilege escalation. The likely attack vector involves an attacker sending a specially crafted SIP message that passes through the kernel’s nf_conntrack module; stack traces in the description indicate IPv6 traffic. Based on the description, it is inferred that the attacker must be able to inject SIP packets into the system, either from a controlled network or by compromising the network path. The kernel impact renders the vulnerability severe in all affected environments.