CVE-2026-72253: netfilter: nf_conntrack_sip: validate skb_dst() before accessing it
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nfconntracksip: validate skbdst() before accessing it
tc ingress and openvswitch do not guarantee routing information to be available. These subsystems use the conntrack helper infrastructure, and the SIP helper relies on the skbdst() to be present if sipexternalmedia is set to 1 (which is disabled by default as a module parameter).
This effectively disables the sipexternalmedia toggle for these subsystems without resulting in a crash.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Set the nf_conntrack_sip module parameter sip_external_media to 1 so that it is disabled (default is disabled as a module parameter), to mitigate the issue where subsystems rely on the conntrack helper infrastructure and no longer crash when skb_dst() is missing.
Linux kernel netfilter nf_conntrack_sip sip_external_media = 1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72253?
CVE-2026-72253 has a risk score of 12, indicating a critical vulnerability in the Linux kernel.
How do I fix CVE-2026-72253?
To fix CVE-2026-72253, ensure that you are using the updated version of the Linux kernel that addresses this vulnerability.
What does CVE-2026-72253 affect?
CVE-2026-72253 affects the netfilter subsystem in the Linux kernel, specifically the nf_conntrack_sip component.
What is the potential impact of CVE-2026-72253?
The potential impact of CVE-2026-72253 includes possible system instability or security issues due to improper validation of routing information.
When was CVE-2026-72253 published?
CVE-2026-72253 was published on August 15, 2026.