CVE-2026-100070: netfilter: nf_nat_sip: rewind offset when NAT shrinks the packet
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nfnatsip: rewind offset when NAT shrinks the packet
sashiko says: If mapaddr() changes the packet length, such as when the public NAT IP string is shorter or longer than the internal IP, coff will still point to the offset relative to the pre-mangled packet. If the packet shrinks, coff could overshoot the correct position, potentially causing the next ctsipparseheaderuri() call to silently skip bytes and miss subsequent Contact headers. Could this lead to a failure to NAT those subsequent headers and leak internal network details?
Affected Software
Event History
Frequently Asked Questions
What traffic is affected by this issue?
The issue affects SIP packet handling by the Linux kernel's nf_nat_sip netfilter component when NAT changes the packet length. It concerns packets with subsequent Contact headers that may be skipped after the packet shrinks.
What condition is needed for the problem to occur?
NAT must rewrite an address in a way that changes packet length, such as translating an internal IP address to a shorter public NAT IP string. The stale parsing offset can then overshoot after the rewrite.
What is the practical impact?
Subsequent SIP Contact headers may not be NATed because the parser silently skips bytes. This can leave internal network details exposed in those headers.
How can I determine whether a system may be exposed?
Review whether the system uses the Linux kernel nf_nat_sip helper for SIP NAT and processes SIP messages containing multiple Contact headers. Exposure requires address rewriting that shrinks the packet.