CVE-2026-100070
MEDIUM 5.5In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_nat_sip: rewind offset when NAT shrinks the packet sashiko says: If map_addr() changes the packet length, such as when the public NAT IP string is shorter or longer than the internal IP, coff will still point to the offset relative to the pre-mangled packet. If the packet shrinks, coff could overshoot the correct position, potentially causing the next ct_sip_parse_header_uri() call to silently skip bytes and miss subsequent Contact headers. Could this lead to a failure to NAT those subsequent headers and leak internal network details?
NO EXPLOITATION SIGNALS
No known exploitation, public exploit, or elevated probability at this time. Track for changes.
Exploitation likelihood
0.1%chance of exploitation in 30 days · 2nd percentile
○ In CISA KEV
○ Catalogued PoC
Impact if exploited
5.5CVSS 3.1 · MEDIUM
- ConfidentialityNone
- IntegrityNone
- AvailabilityHigh
What an attacker needs
- ⚠Access: Requires local access to the host
- ⚠Privileges: Requires a low-privilege account
- ✓User interaction: No user interaction needed
- ✓Complexity: No special conditions — reliably repeatable
✓ lowers the bar for an attacker · ⚠ raises it
Proof of concept
No public PoC is currently catalogued.
Search for new PoCs
Search GitHub now — results may be empty or unverified.
Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.
Data snapshot:
Weakness (CWE)
Not classified.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
References and research data (JSON)
Vendor product assessments
Showing 32 of 277 vendor product statements; 245 omitted. Read the full vendor advisory.
kernel as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel
- workaround: The vulnerable code path is only reachable when the SIP connection tracking/NAT helper is enabled, which is not the default configuration. On systems where the SIP NAT helper has been explicitly enabled, disabling it (for example, by unloading or preventing the loading of the nf_conntrack_sip and nf_nat_sip kernel modules, or by disabling automatic conntrack helper assignment for SIP traffic) prevents netfilter from rewriting SIP payloads and thereby prevents untranslated Contact headers from being sent to external recipients. Note that disabling the helper also disables SIP application-level gateway (ALG) processing, which may affect SIP deployments that rely on it, so the operational impact should be evaluated before applying this change.
- none available: Fix deferred
kernel-abi-stablelists as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-abi-stablelists
- workaround: The vulnerable code path is only reachable when the SIP connection tracking/NAT helper is enabled, which is not the default configuration. On systems where the SIP NAT helper has been explicitly enabled, disabling it (for example, by unloading or preventing the loading of the nf_conntrack_sip and nf_nat_sip kernel modules, or by disabling automatic conntrack helper assignment for SIP traffic) prevents netfilter from rewriting SIP payloads and thereby prevents untranslated Contact headers from being sent to external recipients. Note that disabling the helper also disables SIP application-level gateway (ALG) processing, which may affect SIP deployments that rely on it, so the operational impact should be evaluated before applying this change.
- none available: Fix deferred
kernel-modules-extra-matched as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-modules-extra-matched
- workaround: The vulnerable code path is only reachable when the SIP connection tracking/NAT helper is enabled, which is not the default configuration. On systems where the SIP NAT helper has been explicitly enabled, disabling it (for example, by unloading or preventing the loading of the nf_conntrack_sip and nf_nat_sip kernel modules, or by disabling automatic conntrack helper assignment for SIP traffic) prevents netfilter from rewriting SIP payloads and thereby prevents untranslated Contact headers from being sent to external recipients. Note that disabling the helper also disables SIP application-level gateway (ALG) processing, which may affect SIP deployments that rely on it, so the operational impact should be evaluated before applying this change.
- none available: Fix deferred
kernel-rt-core as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-rt-core
- workaround: The vulnerable code path is only reachable when the SIP connection tracking/NAT helper is enabled, which is not the default configuration. On systems where the SIP NAT helper has been explicitly enabled, disabling it (for example, by unloading or preventing the loading of the nf_conntrack_sip and nf_nat_sip kernel modules, or by disabling automatic conntrack helper assignment for SIP traffic) prevents netfilter from rewriting SIP payloads and thereby prevents untranslated Contact headers from being sent to external recipients. Note that disabling the helper also disables SIP application-level gateway (ALG) processing, which may affect SIP deployments that rely on it, so the operational impact should be evaluated before applying this change.
- none available: Fix deferred
kernel-uki-virt as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-uki-virt
- workaround: The vulnerable code path is only reachable when the SIP connection tracking/NAT helper is enabled, which is not the default configuration. On systems where the SIP NAT helper has been explicitly enabled, disabling it (for example, by unloading or preventing the loading of the nf_conntrack_sip and nf_nat_sip kernel modules, or by disabling automatic conntrack helper assignment for SIP traffic) prevents netfilter from rewriting SIP payloads and thereby prevents untranslated Contact headers from being sent to external recipients. Note that disabling the helper also disables SIP application-level gateway (ALG) processing, which may affect SIP deployments that rely on it, so the operational impact should be evaluated before applying this change.
- none available: Fix deferred
bpftool as a component of Red Hat Enterprise Linux 7 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/bpftool
- workaround: The vulnerable code path is only reachable when the SIP connection tracking/NAT helper is enabled, which is not the default configuration. On systems where the SIP NAT helper has been explicitly enabled, disabling it (for example, by unloading or preventing the loading of the nf_conntrack_sip and nf_nat_sip kernel modules, or by disabling automatic conntrack helper assignment for SIP traffic) prevents netfilter from rewriting SIP payloads and thereby prevents untranslated Contact headers from being sent to external recipients. Note that disabling the helper also disables SIP application-level gateway (ALG) processing, which may affect SIP deployments that rely on it, so the operational impact should be evaluated before applying this change.
- none available: Fix deferred
kernel-rt-devel as a component of Red Hat Enterprise Linux 7 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-rt-devel
- workaround: The vulnerable code path is only reachable when the SIP connection tracking/NAT helper is enabled, which is not the default configuration. On systems where the SIP NAT helper has been explicitly enabled, disabling it (for example, by unloading or preventing the loading of the nf_conntrack_sip and nf_nat_sip kernel modules, or by disabling automatic conntrack helper assignment for SIP traffic) prevents netfilter from rewriting SIP payloads and thereby prevents untranslated Contact headers from being sent to external recipients. Note that disabling the helper also disables SIP application-level gateway (ALG) processing, which may affect SIP deployments that rely on it, so the operational impact should be evaluated before applying this change.
- none available: Fix deferred
kernel-abi-whitelists as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-abi-whitelists
- workaround: The vulnerable code path is only reachable when the SIP connection tracking/NAT helper is enabled, which is not the default configuration. On systems where the SIP NAT helper has been explicitly enabled, disabling it (for example, by unloading or preventing the loading of the nf_conntrack_sip and nf_nat_sip kernel modules, or by disabling automatic conntrack helper assignment for SIP traffic) prevents netfilter from rewriting SIP payloads and thereby prevents untranslated Contact headers from being sent to external recipients. Note that disabling the helper also disables SIP application-level gateway (ALG) processing, which may affect SIP deployments that rely on it, so the operational impact should be evaluated before applying this change.
- none available: Fix deferred
kernel-modules-internal as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-modules-internal
- workaround: The vulnerable code path is only reachable when the SIP connection tracking/NAT helper is enabled, which is not the default configuration. On systems where the SIP NAT helper has been explicitly enabled, disabling it (for example, by unloading or preventing the loading of the nf_conntrack_sip and nf_nat_sip kernel modules, or by disabling automatic conntrack helper assignment for SIP traffic) prevents netfilter from rewriting SIP payloads and thereby prevents untranslated Contact headers from being sent to external recipients. Note that disabling the helper also disables SIP application-level gateway (ALG) processing, which may affect SIP deployments that rely on it, so the operational impact should be evaluated before applying this change.
- none available: Fix deferred
kernel-rt.src as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-rt?arch=src
- workaround: The vulnerable code path is only reachable when the SIP connection tracking/NAT helper is enabled, which is not the default configuration. On systems where the SIP NAT helper has been explicitly enabled, disabling it (for example, by unloading or preventing the loading of the nf_conntrack_sip and nf_nat_sip kernel modules, or by disabling automatic conntrack helper assignment for SIP traffic) prevents netfilter from rewriting SIP payloads and thereby prevents untranslated Contact headers from being sent to external recipients. Note that disabling the helper also disables SIP application-level gateway (ALG) processing, which may affect SIP deployments that rely on it, so the operational impact should be evaluated before applying this change.
- none available: Fix deferred
kernel as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel
- workaround: The vulnerable code path is only reachable when the SIP connection tracking/NAT helper is enabled, which is not the default configuration. On systems where the SIP NAT helper has been explicitly enabled, disabling it (for example, by unloading or preventing the loading of the nf_conntrack_sip and nf_nat_sip kernel modules, or by disabling automatic conntrack helper assignment for SIP traffic) prevents netfilter from rewriting SIP payloads and thereby prevents untranslated Contact headers from being sent to external recipients. Note that disabling the helper also disables SIP application-level gateway (ALG) processing, which may affect SIP deployments that rely on it, so the operational impact should be evaluated before applying this change.
- none available: Fix deferred
kernel-64k-modules-extra as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-64k-modules-extra
- workaround: The vulnerable code path is only reachable when the SIP connection tracking/NAT helper is enabled, which is not the default configuration. On systems where the SIP NAT helper has been explicitly enabled, disabling it (for example, by unloading or preventing the loading of the nf_conntrack_sip and nf_nat_sip kernel modules, or by disabling automatic conntrack helper assignment for SIP traffic) prevents netfilter from rewriting SIP payloads and thereby prevents untranslated Contact headers from being sent to external recipients. Note that disabling the helper also disables SIP application-level gateway (ALG) processing, which may affect SIP deployments that rely on it, so the operational impact should be evaluated before applying this change.
- none available: Fix deferred
kernel-debug-uki-virt as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-debug-uki-virt
- workaround: The vulnerable code path is only reachable when the SIP connection tracking/NAT helper is enabled, which is not the default configuration. On systems where the SIP NAT helper has been explicitly enabled, disabling it (for example, by unloading or preventing the loading of the nf_conntrack_sip and nf_nat_sip kernel modules, or by disabling automatic conntrack helper assignment for SIP traffic) prevents netfilter from rewriting SIP payloads and thereby prevents untranslated Contact headers from being sent to external recipients. Note that disabling the helper also disables SIP application-level gateway (ALG) processing, which may affect SIP deployments that rely on it, so the operational impact should be evaluated before applying this change.
- none available: Fix deferred
kernel-rt-64k-debug as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-rt-64k-debug
- workaround: The vulnerable code path is only reachable when the SIP connection tracking/NAT helper is enabled, which is not the default configuration. On systems where the SIP NAT helper has been explicitly enabled, disabling it (for example, by unloading or preventing the loading of the nf_conntrack_sip and nf_nat_sip kernel modules, or by disabling automatic conntrack helper assignment for SIP traffic) prevents netfilter from rewriting SIP payloads and thereby prevents untranslated Contact headers from being sent to external recipients. Note that disabling the helper also disables SIP application-level gateway (ALG) processing, which may affect SIP deployments that rely on it, so the operational impact should be evaluated before applying this change.
- none available: Fix deferred
kernel-rt-64k-modules-internal as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-rt-64k-modules-internal
- workaround: The vulnerable code path is only reachable when the SIP connection tracking/NAT helper is enabled, which is not the default configuration. On systems where the SIP NAT helper has been explicitly enabled, disabling it (for example, by unloading or preventing the loading of the nf_conntrack_sip and nf_nat_sip kernel modules, or by disabling automatic conntrack helper assignment for SIP traffic) prevents netfilter from rewriting SIP payloads and thereby prevents untranslated Contact headers from being sent to external recipients. Note that disabling the helper also disables SIP application-level gateway (ALG) processing, which may affect SIP deployments that rely on it, so the operational impact should be evaluated before applying this change.
- none available: Fix deferred
kernel-rt-kvm as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-rt-kvm
- workaround: The vulnerable code path is only reachable when the SIP connection tracking/NAT helper is enabled, which is not the default configuration. On systems where the SIP NAT helper has been explicitly enabled, disabling it (for example, by unloading or preventing the loading of the nf_conntrack_sip and nf_nat_sip kernel modules, or by disabling automatic conntrack helper assignment for SIP traffic) prevents netfilter from rewriting SIP payloads and thereby prevents untranslated Contact headers from being sent to external recipients. Note that disabling the helper also disables SIP application-level gateway (ALG) processing, which may affect SIP deployments that rely on it, so the operational impact should be evaluated before applying this change.
- none available: Fix deferred
kernel-zfcpdump-devel as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/kernel-zfcpdump-devel
- workaround: The vulnerable code path is only reachable when the SIP connection tracking/NAT helper is enabled, which is not the default configuration. On systems where the SIP NAT helper has been explicitly enabled, disabling it (for example, by unloading or preventing the loading of the nf_conntrack_sip and nf_nat_sip kernel modules, or by disabling automatic conntrack helper assignment for SIP traffic) prevents netfilter from rewriting SIP payloads and thereby prevents untranslated Contact headers from being sent to external recipients. Note that disabling the helper also disables SIP application-level gateway (ALG) processing, which may affect SIP deployments that rely on it, so the operational impact should be evaluated before applying this change.
- none available: Fix deferred
openshift/ose-rhel-coreos-9 as a component of Red Hat OpenShift Container Platform 4 · known affected
Vendor assessment for this product only.
pkg:oci/ose-rhel-coreos-9?repository_url=registry.redhat.io/openshift/ose-rhel-coreos-9
- workaround: The vulnerable code path is only reachable when the SIP connection tracking/NAT helper is enabled, which is not the default configuration. On systems where the SIP NAT helper has been explicitly enabled, disabling it (for example, by unloading or preventing the loading of the nf_conntrack_sip and nf_nat_sip kernel modules, or by disabling automatic conntrack helper assignment for SIP traffic) prevents netfilter from rewriting SIP payloads and thereby prevents untranslated Contact headers from being sent to external recipients. Note that disabling the helper also disables SIP application-level gateway (ALG) processing, which may affect SIP deployments that rely on it, so the operational impact should be evaluated before applying this change.
- none available: Fix deferred
kernel as a component of Red Hat Enterprise Linux 6 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel
Red Hat · CVE-2026-100070 · Updated 2026-10-20T19:55:34+00:00kernel-abi-whitelists as a component of Red Hat Enterprise Linux 6 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-abi-whitelists
Red Hat · CVE-2026-100070 · Updated 2026-10-20T19:55:34+00:00kernel-bootwrapper as a component of Red Hat Enterprise Linux 6 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-bootwrapper
Red Hat · CVE-2026-100070 · Updated 2026-10-20T19:55:34+00:00kernel-debug as a component of Red Hat Enterprise Linux 6 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-debug
Red Hat · CVE-2026-100070 · Updated 2026-10-20T19:55:34+00:00kernel-debug-devel as a component of Red Hat Enterprise Linux 6 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-debug-devel
Red Hat · CVE-2026-100070 · Updated 2026-10-20T19:55:34+00:00kernel-devel as a component of Red Hat Enterprise Linux 6 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-devel
Red Hat · CVE-2026-100070 · Updated 2026-10-20T19:55:34+00:00kernel-doc as a component of Red Hat Enterprise Linux 6 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-doc
Red Hat · CVE-2026-100070 · Updated 2026-10-20T19:55:34+00:00kernel-firmware as a component of Red Hat Enterprise Linux 6 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-firmware
Red Hat · CVE-2026-100070 · Updated 2026-10-20T19:55:34+00:00kernel-headers as a component of Red Hat Enterprise Linux 6 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-headers
Red Hat · CVE-2026-100070 · Updated 2026-10-20T19:55:34+00:00kernel-kdump as a component of Red Hat Enterprise Linux 6 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-kdump
Red Hat · CVE-2026-100070 · Updated 2026-10-20T19:55:34+00:00kernel-kdump-devel as a component of Red Hat Enterprise Linux 6 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-kdump-devel
Red Hat · CVE-2026-100070 · Updated 2026-10-20T19:55:34+00:00kernel.src as a component of Red Hat Enterprise Linux 6 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel?arch=src
Red Hat · CVE-2026-100070 · Updated 2026-10-20T19:55:34+00:00perf as a component of Red Hat Enterprise Linux 6 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/perf
Red Hat · CVE-2026-100070 · Updated 2026-10-20T19:55:34+00:00python-perf as a component of Red Hat Enterprise Linux 6 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/python-perf
Red Hat · CVE-2026-100070 · Updated 2026-10-20T19:55:34+00:00
Known Affected Software Configurations
| Vendor | Product | Version range |
|---|---|---|
| Linux | Linux Kernel | ≥ 2.6.26 and < 5.10.270 |
| Linux | Linux Kernel | ≥ 5.11 and < 5.15.221 |
| Linux | Linux Kernel | ≥ 5.16 and < 6.1.188 |
| Linux | Linux Kernel | ≥ 6.2 and < 6.6.157 |
| Linux | Linux Kernel | ≥ 6.7 and < 6.12.110 |
| Linux | Linux Kernel | ≥ 6.13 and < 6.18.52 |
| Linux | Linux Kernel | ≥ 6.19 and < 7.2.6 |
References
Patches & mitigations
- https://git.kernel.org/stable/c/6828aca3d82717c2fda92af81c0dda642bc2b465 CVE record · Linux · Updated 2026-10-19T08:43:02.432Z
NVD · CVE-2026-100070 · Updated 2026-10-20T18:19:31.813 - https://git.kernel.org/stable/c/2703f5ea8d85bc729f433ac09ee902084c947122 CVE record · Linux · Updated 2026-10-19T08:43:02.432Z
NVD · CVE-2026-100070 · Updated 2026-10-20T18:19:31.813 - https://git.kernel.org/stable/c/0f4d30e2e49f343fc28ba1e259fd22969b940c46 CVE record · Linux · Updated 2026-10-19T08:43:02.432Z
NVD · CVE-2026-100070 · Updated 2026-10-20T18:19:31.813 - https://git.kernel.org/stable/c/810da5a63549531da78348b0a4545042d84e01e2 CVE record · Linux · Updated 2026-10-19T08:43:02.432Z
NVD · CVE-2026-100070 · Updated 2026-10-20T18:19:31.813 - https://git.kernel.org/stable/c/668cc1c30caedc63070b10d17d5514748988a140 CVE record · Linux · Updated 2026-10-19T08:43:02.432Z
NVD · CVE-2026-100070 · Updated 2026-10-20T18:19:31.813 - https://git.kernel.org/stable/c/e70d48fcf8382581162608a4a322919bfd22aef3 CVE record · Linux · Updated 2026-10-19T08:43:02.432Z
NVD · CVE-2026-100070 · Updated 2026-10-20T18:19:31.813 - https://git.kernel.org/stable/c/c408d416618ebb8a95e3097a13f3b793ea9272ee CVE record · Linux · Updated 2026-10-19T08:43:02.432Z
NVD · CVE-2026-100070 · Updated 2026-10-20T18:19:31.813 - https://git.kernel.org/stable/c/16aecbe3036f6097c26b51b12e4c1cf207769690 CVE record · Linux · Updated 2026-10-19T08:43:02.432Z
NVD · CVE-2026-100070 · Updated 2026-10-20T18:19:31.813
Advisories
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-100070.json Red Hat · CVE-2026-100070 · Updated 2026-10-20T19:55:34+00:00
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-87067 EUVD · EUVD-2026-87067
Technical & other
- https://access.redhat.com/security/cve/CVE-2026-100070 Red Hat · CVE-2026-100070 · Updated 2026-10-20T19:55:34+00:00
- https://bugzilla.redhat.com/show_bug.cgi?id=2541421 Red Hat · CVE-2026-100070 · Updated 2026-10-20T19:55:34+00:00
- https://www.cve.org/CVERecord?id=CVE-2026-100070 Red Hat · CVE-2026-100070 · Updated 2026-10-20T19:55:34+00:00
- https://nvd.nist.gov/vuln/detail/CVE-2026-100070 Red Hat · CVE-2026-100070 · Updated 2026-10-20T19:55:34+00:00
- https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-100070.mbox Red Hat · CVE-2026-100070 · Updated 2026-10-20T19:55:34+00:00