CVE-2026-52986: netfilter: nf_conntrack_sip: don't use simple_strtoul

Affected Software

Remediation

Recommended actions to resolve this vulnerability, in priority order.

1. Upgrade

   Upgrade to a fixed release to a version that resolves this vulnerability.

   Fixed in 6.6.143.1-1
2. Upgrade

   Upgrade debian/linux to a version that resolves this vulnerability.

   Fixed in 5.10.262-1Fixed in 6.1.176-1Fixed in 6.1.180-1Fixed in 6.12.94-1Fixed in 6.12.101-1Fixed in 7.1.8-2Fixed in 7.1.10-1
3. Upgrade

   Upgrade debian/linux-6.1 to a version that resolves this vulnerability.

   Fixed in 6.1.180-1~deb11u1
4. Configuration

   Replace unsafe port parsing in epaddr_len(), ct_sip_parse_header_uri(), and ct_sip_parse_request() with a new sip_parse_port() helper that validates each digit against the buffer limit, eliminating use of simple_strtoul() on non-NUL-terminated skb data.

   nf_conntrack_sip sip_parse_port() helper validation (replace simple_strtoul usage) = enabled
5. Configuration

   Force base 10 in ct_sip_parse_numerical_param() for parsing 'expire=' and 'rports=' (both expected to use base-10).

   ct_sip_parse_numerical_param() number base handling for parameters expire= and rports= = base-10
6. Configuration

   Update epaddr_len() to return 0 when the port is invalid (and for invalid IP addresses as it already does).

   epaddr_len() invalid port handling = return 0
7. Configuration

   In sip_parse_port(), bail out and indicate failure if number is > UINT_MAX, and reject ports that reach the buffer limit without a trailing character (treat as malformed).

   sip_parse_port() numeric overflow and malformed termination handling = reject malformed/overflow
8. Configuration

   In nf_nat_sip.c, only accept the parsed SIP port value if it is within the 1k-64k range.

   nf_nat_sip parsed port acceptance range = 1k-64k only

Event History

Frequently Asked Questions