CVE-2026-31427: Linux Kernel Use-After-Free Vulnerability

CVE-2026-31427 Overview

CVE-2026-31427 is an uninitialized memory use vulnerability in the Linux kernel's netfilter nf_conntrack_sip module. The flaw exists in the process_sdp() function, which improperly handles the rtp_addr variable when processing SIP (Session Initiation Protocol) messages containing SDP (Session Description Protocol) bodies.

The vulnerability occurs because process_sdp() declares a union nf_inet_addr rtp_addr on the stack and passes it to the nf_nat_sip sdp_session hook without proper initialization. The rtp_addr variable is only initialized inside a media loop when a recognized media type with a non-zero port is found. When SDP bodies contain no m= lines, only inactive media sections (m=audio 0 ...), or only unrecognized media types, the variable remains uninitialized yet is still passed to the hook functions.

Critical Impact

Exploitation of this vulnerability can cause SDP session owner and connection lines to be rewritten with stale stack values, potentially exposing memory contents or causing network communication issues with addresses being incorrectly rewritten to 0.0.0.0.

Affected Products

• Linux Kernel (netfilter subsystem)
• Systems using nf_conntrack_sip module for SIP connection tracking
• Systems using nf_nat_sip for SIP NAT translation

Discovery Timeline

• April 13, 2026 - CVE-2026-31427 published to NVD
• April 13, 2026 - Last updated in NVD database

Technical Details for CVE-2026-31427

Vulnerability Analysis

The vulnerability resides in the process_sdp() function within the netfilter nf_conntrack_sip connection tracking helper. When processing SIP INVITE messages or similar SIP signaling that contains SDP media descriptions, the function declares a union nf_inet_addr rtp_addr variable on the stack without initialization.

Under normal operation, this variable should be populated when the code iterates through SDP media descriptions (lines beginning with m=) and identifies a valid media type with a non-zero port number. However, several edge cases exist where this initialization never occurs:

1. The SDP body contains no m= lines at all
2. All media sections are marked as inactive with port 0 (e.g., m=audio 0 RTP/AVP 0)
3. The SDP contains only unrecognized media types

When any of these conditions are met, the code still proceeds to call hooks->sdp_session() with the uninitialized &rtp_addr pointer. The nf_nat_sdp_session() function then formats this stale stack value as an IP address and rewrites the SDP session-level o= (origin) and c= (connection) lines with it.

Root Cause

The root cause is improper variable initialization in C code combined with insufficient validation before use. The rtp_addr variable is conditionally initialized within a loop but unconditionally used after the loop completes. This violates the secure coding principle of ensuring all variables are initialized before use, particularly when those variables may contain sensitive stack data.

On systems with CONFIG_INIT_STACK_ALL_ZERO enabled (default on most modern distributions), this results in addresses being rewritten to 0.0.0.0. Without this kernel configuration option, the rewritten address contains whatever arbitrary data happened to be on the stack at that location, potentially leaking kernel memory contents.

Attack Vector

An attacker can exploit this vulnerability by sending specially crafted SIP messages through a system that uses the nf_conntrack_sip and nf_nat_sip kernel modules for connection tracking and NAT. The attack vector requires:

1. Network access to send SIP signaling through the target system
2. The target system must have the nf_conntrack_sip module loaded and active
3. The SIP message must contain an SDP body with no valid media descriptions (no m= lines, all inactive ports, or unrecognized media types)

The vulnerability is triggered during normal packet processing, requiring no authentication. The resulting corruption affects SDP session address rewriting, which could disrupt legitimate VoIP communications or potentially expose stack memory contents in the modified SDP response.

Detection Methods for CVE-2026-31427

Indicators of Compromise

• Unusual SDP session addresses appearing as 0.0.0.0 in SIP signaling traffic
• VoIP communication failures where connection addresses are incorrectly rewritten
• Anomalous IP addresses in SDP o= and c= lines that don't match expected network topology
• Kernel log messages related to nf_conntrack_sip or nf_nat_sip processing errors

Detection Strategies

• Monitor SIP traffic for SDP bodies with session-level addresses rewritten to 0.0.0.0 or unexpected values
• Implement deep packet inspection rules to flag SIP messages with malformed or suspicious SDP content
• Deploy kernel auditing to track nf_conntrack_sip module activity and processing anomalies
• Use network intrusion detection systems (IDS) with signatures for crafted SIP/SDP packets

Monitoring Recommendations

• Enable verbose logging for netfilter connection tracking on systems processing SIP traffic
• Monitor VoIP gateway and SBC (Session Border Controller) logs for media setup failures
• Implement SIP-aware monitoring to detect address translation anomalies
• Review kernel crash dumps for stack-related issues in netfilter SIP processing paths

How to Mitigate CVE-2026-31427

Immediate Actions Required

• Apply the official kernel patch from the Linux kernel stable branches
• If immediate patching is not possible, consider temporarily unloading the nf_conntrack_sip module if SIP tracking is not required
• Ensure CONFIG_INIT_STACK_ALL_ZERO is enabled to reduce potential information disclosure impact
• Review and restrict network access to systems performing SIP NAT translation

Patch Information

The vulnerability has been addressed in multiple Linux kernel stable branches. The fix pre-initializes rtp_addr from the session-level connection address (caddr) when available and introduces a have_rtp_addr flag to track whether any valid address was established. The sdp_session hook is now skipped entirely when no valid address exists.

Official patches are available from the following kernel commits:

• Kernel Patch Proposal 01f34a80
• Kernel Patch Proposal 52fdda31
• Kernel Patch Proposal 6a2b7244
• Kernel Patch Proposal 6e5e3c87
• Kernel Patch Proposal 7edca707
• Kernel Patch Proposal fe463e76

Workarounds

• Unload the nf_conntrack_sip module if SIP connection tracking is not required: modprobe -r nf_conntrack_sip
• Blacklist the module to prevent automatic loading by adding blacklist nf_conntrack_sip to /etc/modprobe.d/blacklist.conf
• Implement external SIP ALG (Application Layer Gateway) solutions that don't rely on the kernel module
• Use dedicated SIP-aware firewalls or SBCs instead of kernel-based SIP NAT

# Disable nf_conntrack_sip module temporarily
modprobe -r nf_conntrack_sip

# Prevent automatic loading (add to /etc/modprobe.d/blacklist-sip.conf)
echo "blacklist nf_conntrack_sip" >> /etc/modprobe.d/blacklist-sip.conf
echo "blacklist nf_nat_sip" >> /etc/modprobe.d/blacklist-sip.conf

# Verify module is not loaded
lsmod | grep sip