REDHAT-BUG-2492329: High severity Linux Linux kernel vulnerability
In the Linux kernel, the following vulnerability has been resolved:
netfilter: conntrack: remove sprintf usage
Replace it with scnprintf, the buffer sizes are expected to be large enough to hold the result, no need for snprintf+overflow check.
Increase buffer size in manglecontentlen() while at it.
BUG: KASAN: stack-out-of-bounds in vsnprintf+0xea5/0x1270 Write of size 1 at addr [..] vsnprintf+0xea5/0x1270 sprintf+0xb1/0xe0 manglecontentlen+0x1ac/0x280 nfnatsdpsession+0x1cc/0x240 processsdp+0x8f8/0xb80 processinviterequest+0x108/0x2b0 processsipmsg+0x5da/0xf50 siphelptcp+0x45e/0x780 nfconfirm+0x34d/0x990 [..]
Affected Software
Event History
Frequently Asked Questions
Which kernel subsystem and traffic-processing path are implicated?
The reported stack trace involves netfilter connection tracking and NAT processing for SIP/SDP traffic. The path shown includes SIP TCP handling, SDP processing, and nf_nat_sdp_session().
What evidence might indicate that a system has encountered this issue?
The reported failure is a KASAN stack-out-of-bounds write in vsnprintf(), reached through sprintf() and mangle_content_len(). Kernel diagnostics may show stack frames including mangle_content_len, nf_nat_sdp_session, process_sdp, and sip_help_tcp.
Where can administrators obtain the vendor fixes?
The provided references include Red Hat advisories RHSA-2026:64770 and RHSA-2026:66000. The supplied data does not identify the affected or fixed kernel versions.