External risk intelligence

Linux Kernel Netfilter SIP NAT Rewrite Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-74569

The vulnerability exists in the Linux kernel's Netfilter SIP conntrack helper. This code path is only reachable if SIP connection tracking and NAT are explicitly enabled on a device. While common in edge firewalls or routers handling VoIP traffic, it is not a default or universal configuration across all Linux systems, limiting the attack surface to specifically configured network infrastructure.

Use After Free

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in the Linux kernel's network filtering component could allow unauthorized access to system memory if specific network traffic is processed. This issue arises from how the system handles changes in network packet sizes during certain network address translation operations, potentially leading to memory corruption. The primary concern is confirming if your environment utilizes the affected kernel features.

Software could be tricked into reading past memory limits.
Impacts network devices handling specific voice traffic.
Confirm if the affected feature is enabled in your systems.

Attack Path

How an attacker could exploit the issue

An attacker could trigger this vulnerability by sending specially crafted SIP packets over the network. The Linux kernel's Netfilter component, specifically the SIP conntrack helper, attempts to rewrite these packets for Network Address Translation (NAT). If a SIP message is excessively large due to a long `Contact` header, the internal calculation of the message size change can wrap around, leading to incorrect memory access and a potential use-after-free condition.

Requires SIP connection tracking and NAT.
Triggered by malformed SIP packets.
Leads to memory corruption.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker to trigger a use-after-free condition when processing specifically crafted SIP messages, potentially leading to system instability or denial of service. This occurs when the system miscalculates the size change of a NAT-rewritten SIP message, causing subsequent operations to read beyond allocated memory.

Kernel memory access.
Crafted SIP packets trigger overflow.
System instability or denial of service.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability resides within the Linux kernel's Netfilter subsystem, specifically impacting the SIP conntrack helper. Responsibility for addressing this likely falls to infrastructure or platform teams managing network devices that perform SIP-aware connection tracking and Network Address Translation (NAT). The immediate priority is to identify all Linux systems where SIP conntrack and NAT are enabled, confirm their exposure to network traffic, and determine the accountable system owner before planning remediation.

Owner: Infrastructure or platform teams.
Verify: SIP conntrack/NAT enabled systems.
Action: Remediate based on exposure.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Linux kernel's Netfilter SIP conntrack helper?

It is a specialized component within the Linux kernel that tracks and manages SIP traffic, commonly used in VoIP communications. It allows routers and firewalls to perform Network Address Translation (NAT) on SIP packets, ensuring that voice calls can be correctly routed through devices even when internal IP addresses are hidden.

How does CVE-2026-74569 cause memory corruption?

The vulnerability involves an integer overflow weakness. When the kernel processes SIP messages that grow significantly during NAT rewriting—such as those with very long contact lists—it incorrectly calculates the new message size. This math error causes the system to read memory locations beyond the intended buffer, potentially leading to a use-after-free condition.

Does any SIP traffic trigger this vulnerability?

No. The vulnerability requires the specific condition of SIP connection tracking and NAT to be enabled. It is triggered by specially crafted, excessively large SIP packets that force the internal size calculation to wrap around. Standard, properly sized SIP traffic does not trigger this memory access error.

Is my network device at risk according to Halo Surface Signal?

Halo Surface Signal indicates this is a possible concern only if your Linux systems are configured as edge firewalls or routers that specifically perform SIP NAT rewriting. Since this feature is not universal or enabled by default on all Linux distributions, systems not acting as SIP-aware network gateways are unlikely to be reachable for this attack.

What is the first step to address this CVE?

Begin by auditing your infrastructure to identify which Linux devices have SIP connection tracking and NAT enabled. Focus your assessment on network-facing appliances and voice gateways. Once you have identified these specific systems, coordinate with your platform team to prepare for kernel updates that increase the internal size calculation variables to accommodate larger packet changes.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.