CVE-2026-52986: netfilter: nf_conntrack_sip: don't use simple_strtoul
In the Linux kernel, the following vulnerability has been resolved:
Other sources
netfilter: nfconntracksip: don't use simplestrtoul
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.143.1-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.262-1Fixed in 6.1.176-1Fixed in 6.1.180-1Fixed in 6.12.94-1Fixed in 6.12.101-1Fixed in 7.1.8-2Fixed in 7.1.10-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.180-1~deb11u1 - Compensating control
Update nf_conntrack_sip to replace simple_strtoul()-based parsing in epaddr_len(), ct_sip_parse_header_uri(), and ct_sip_parse_request() with sip_parse_port(); validate digits within the buffer limit, reject ports that reach the buffer limit without a trailing character, reject values equal to or greater than UINT_MAX, force base 10 in ct_sip_parse_numerical_param(), and in nf_nat_sip accept parsed ports only within the 1k-64k range.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-52986?
CVE-2026-52986 has a severity rating of critical with a score of 9.8.
How do I fix CVE-2026-52986?
To fix CVE-2026-52986, update your Linux kernel to the patched version that replaces unsafe port parsing in the relevant functions.
What systems are affected by CVE-2026-52986?
CVE-2026-52986 affects the Linux kernel, specifically the netfilter nf_conntrack_sip component.
What impact does CVE-2026-52986 have?
CVE-2026-52986 can lead to critical vulnerabilities such as denial of service or remote code execution due to unsafe port parsing.
When was CVE-2026-52986 published?
CVE-2026-52986 was published on June 24, 2026.