CVE-2026-23457 netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp()
An integer truncation in the Linux kernel SIP conntrack parser allows attackers to cause denial of service or unexpected parsing behavior via crafted SIP messages.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-23457?
CVE-2026-23457 is a high-severity vulnerability in Linux kernel, published on 3 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp()
sip_help_tcp() parses the SIP Content-Length header with simple_strtoul(), which returns unsigned long, but stores the result in unsigned int clen. On 64-bit systems, values exceeding UINT_MAX are silently truncated before computing the SIP message boundary.
For example, Content-Length 4294967328 (2^32 + 32) is truncated to 32, causing the parser to miscalculate where the current message ends. The loop then treats trailing data in the TCP segment as a second SIP message and processes it through the SDP parser.
Fix this by changing clen to unsigned long to match the return type of simple_strtoul(), and reject Content-Length values that exceed the remaining TCP payload length.
Weakness: CWE-190
Which versions are affected by CVE-2026-23457?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-23457?
Apply the vendor's patch.
Is CVE-2026-23457 being exploited?
There is no known exploitation of CVE-2026-23457 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-23457, DEBIAN-CVE-2026-23457, GHSA-4q45-qq5w-x2fj, ROOT-OS-DEBIAN-11-CVE-2026-23457, ROOT-OS-DEBIAN-12-CVE-2026-23457, ROOT-OS-DEBIAN-13-CVE-2026-23457 and 3 more.