CVE-2026-72253: netfilter: nf_conntrack_sip: validate skb_dst() before accessing it
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nfconntracksip: validate skbdst() before accessing it
tc ingress and openvswitch do not guarantee routing information to be available. These subsystems use the conntrack helper infrastructure, and the SIP helper relies on the skbdst() to be present if sipexternalmedia is set to 1 (which is disabled by default as a module parameter).
This effectively disables the sipexternalmedia toggle for these subsystems without resulting in a crash.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Set the nf_conntrack_sip module parameter sip_external_media to 1 so that it is disabled (default is disabled as a module parameter), to mitigate the issue where subsystems rely on the conntrack helper infrastructure and no longer crash when skb_dst() is missing.
Linux kernel netfilter nf_conntrack_sip sip_external_media = 1