CVE-2026-98077: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-98077 Overview

CVE-2026-98077 is an out-of-bounds read vulnerability in the Linux kernel's netfilter Session Initiation Protocol (SIP) connection tracking module nf_conntrack_sip. The flaw resides in the sip_skip_whitespace() helper function, which fails to signal end-of-buffer conditions consistently with its sibling parser sip_follow_continuation(). When a SIP payload ends with a recognized header name followed only by whitespace and no colon, the next statement in ct_sip_get_header() reads one byte past the buffer boundary. The issue has been resolved upstream through four stable kernel patch commits.

Critical Impact
A malformed SIP packet traversing a Linux system running nf_conntrack_sip can trigger a single-byte heap out-of-bounds read, potentially leading to information disclosure or kernel instability.

Affected Products

Linux kernel versions containing the nf_conntrack_sip module prior to the fix commits
Systems using netfilter SIP connection tracking or SIP application-layer gateway (ALG) features
Distributions shipping affected stable kernel branches before backporting commits 4a30aa2, 4be8380, 60c012b, or e8f8231

Discovery Timeline

2026-09-25 - CVE-2026-98077 published to the National Vulnerability Database
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-98077

Vulnerability Analysis

The nf_conntrack_sip module parses SIP control messages so that netfilter can track associated media streams and open the correct pinholes. SIP parsing relies on two helper functions that walk forward through the payload buffer: sip_skip_whitespace() and sip_follow_continuation(). By convention, both helpers should return NULL when the buffer is exhausted so that callers can detect end-of-data safely.

sip_skip_whitespace() violated this convention. When its own loop consumed every remaining byte so that dptr == limit, it returned dptr unchanged instead of NULL. The caller ct_sip_get_header() only tests for NULL before dereferencing *dptr, so the pointer check passes and the code reads one byte past the end of the SIP payload.

The out-of-bounds read is a single byte adjacent to the SIP payload buffer. Depending on allocator layout, this can disclose kernel heap contents to subsequent parsing branches or trigger KASAN splats and potential crashes.

Root Cause

The root cause is inconsistent sentinel semantics between two sibling parser helpers [CWE-125 Out-of-Bounds Read]. sip_follow_continuation() returns NULL on its no-more-data path, while sip_skip_whitespace() returned the exhausted pointer. Callers were coded against the NULL-returning convention, so the one-byte over-read was unavoidable once a recognized header name was followed by trailing whitespace that ran exactly to the end of the buffer with no terminating colon.

Attack Vector

An attacker crafts a SIP message whose last header line consists of a valid header name followed only by spaces or tabs, with the whitespace extending exactly to the final byte of the SIP payload and no colon separator. If the message traverses a Linux host that performs SIP connection tracking, the kernel parser reads one byte beyond the SKB data region.

SIP ALG is commonly enabled on edge routers, firewalls, and voice gateways, so remote network reachability to such a device is sufficient to reach the vulnerable code path. No authentication is required.

No verified public exploit code is available. See the upstream patches for technical details: Kernel Patch Commit 4a30aa2, Kernel Patch Commit 4be8380, Kernel Patch Commit 60c012b, and Kernel Patch Commit e8f8231.

Detection Methods for CVE-2026-98077

Indicators of Compromise

Unexpected KASAN slab-out-of-bounds or BUG: unable to handle page fault reports in dmesg referencing sip_skip_whitespace, ct_sip_get_header, or nf_conntrack_sip.
Kernel oops entries or soft lockups on hosts with the nf_conntrack_sip module loaded and processing untrusted SIP traffic.
Malformed SIP packets containing a header name followed only by whitespace terminating the UDP or TCP payload with no colon.

Detection Strategies

Audit loaded kernel modules for nf_conntrack_sip with lsmod | grep sip and correlate against the installed kernel version to identify unpatched hosts.
Deploy KASAN-enabled test kernels in staging to surface the out-of-bounds read when fuzzing SIP inputs against the connection tracker.
Review network IDS signatures for SIP messages whose final header line lacks a colon separator and ends on a whitespace byte.

Monitoring Recommendations

Centralize kernel ring buffer logs and alert on new occurrences of nf_conntrack_sip stack frames in oops traces.
Monitor SIP ALG hosts for abnormal connection tracking entry churn or sudden conntrack table resets that may indicate exploitation attempts.
Track package versions of the Linux kernel across the fleet and flag hosts still running pre-patch builds.

How to Mitigate CVE-2026-98077

Immediate Actions Required

Apply the stable kernel update containing commit 4a30aa2ba007, 4be8380e3af0, 60c012b2d05e, or e8f8231824b5 as shipped by your distribution.
Reboot affected hosts after kernel installation so the patched nf_conntrack_sip code is active.
Inventory firewalls, voice gateways, and SBCs running Linux to confirm they are on fixed kernel builds.

Patch Information

The fix updates sip_skip_whitespace() so that both no-more-data outcomes return NULL, matching the convention already used by sip_follow_continuation() and expected by both existing callers. Patches are available in the upstream stable tree via commits 4a30aa2, 4be8380, 60c012b, and e8f8231. Consult your distribution's security tracker for the backported package version.

Workarounds

Unload the nf_conntrack_sip module with modprobe -r nf_conntrack_sip on systems that do not require SIP ALG functionality.
Blacklist the module in /etc/modprobe.d/ to prevent automatic reload after reboot where SIP tracking is not needed.
Restrict SIP traffic ingress at the network edge so untrusted sources cannot reach hosts running the vulnerable connection tracker.

bash

# Prevent nf_conntrack_sip from loading until the kernel is patched
echo 'blacklist nf_conntrack_sip' | sudo tee /etc/modprobe.d/disable-sip-ct.conf
sudo modprobe -r nf_conntrack_sip