Vulnpedia
← All CVEs

CVE-2026-74569

CRITICAL 9.8 ALL-YEARS

Published 2026-08-15 · Last modified 2026-10-16 · Linux · NVD: Received

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() sip_help_tcp() stores the size change of each NAT-rewritten SIP message in s16 diff and accumulates it in s16 tdiff, but a single message can grow by more than S16_MAX while the packet stays under the 65535 enlarge_skb() limit: nf_nat_sip() rewrites every matching URI, and a long Contact list expands the message by tens of kilobytes. diff then wraps, and "datalen = datalen + diff - msglen" yields a huge unsigned datalen, so the next iteration's ct_sip_get_header() reads past the linearized skb tail. Widen diff, tdiff and the seq_adjust hook to s32. Both are bounded by the 65535 byte packet limit, and the seqadj core is already s32 (nf_ct_seqadj_set() takes s32), so no previously accepted input is rejected. BUG: KASAN: use-after-free in ct_sip_get_header (net/netfilter/nf_conntrack_sip.c:464) Read of size 1 at addr ffff888010800000 by task ksoftirqd/1/25 ct_sip_get_header (net/netfilter/nf_conntrack_sip.c:464) sip_help_tcp (net/netfilter/nf_conntrack_sip.c:1694) nf_confirm (net/netfilter/nf_conntrack_proto.c:183) nf_hook_slow (net/netfilter/core.c:619) ip6_output (net/ipv6/ip6_output.c:246) ip6_forward (net/ipv6/ip6_output.c:690) ipv6_rcv (net/ipv6/ip6_input.c:351) __netif_receive_skb_one_core (net/core/dev.c:6212) process_backlog (net/core/dev.c:6676) __napi_poll (net/core/dev.c:7735) net_rx_

ELEVATED IMPACT

Severe if exploited (CVSS 9.8), but no confirmed exploitation. Patch on a normal cadence.

Exploitation likelihood

0.4%chance of exploitation in 30 days · 33rd percentile

○ In CISA KEV○ Catalogued PoC◆ SSVC: exploitation none, automatable yes

Impact if exploited

9.8CVSS 3.1 · CRITICAL · CNA

  • ConfidentialityHigh
  • IntegrityHigh
  • AvailabilityHigh

What an attacker needs

  • ✓Access: Reachable over the network — no local access needed
  • ✓Privileges: No account or privileges required
  • ✓User interaction: No user interaction needed
  • ✓Complexity: No special conditions — reliably repeatable

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept

No public PoC is currently catalogued.

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked weekly for the full archive, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Affected

Vendors Linux

Products Linux

Weakness (CWE)

Not classified.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References and research data (JSON)

Vendor product assessments

Showing 32 of 826 vendor product statements; 794 omitted. Read the full vendor advisory.

  • kernel-64k-debug-debuginfo-0:6.12.0-211.59.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_2?arch=aarch64

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Red Hat recommends treating all kernel errata as security-relevant. Given the kernel's fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers' overall security posture. Because of this proactive approach, a patch may be associated with a CVE assignment at a future date. Retroactive CVE assignments are always documented in the corresponding errata and on Red Hat's CVE pages. We strongly advise against delaying updates, as doing so may leave your system exposed when protections are already available. Vendor guidance
    Red Hat · CVE-2026-74569 · Updated 2026-10-08T21:17:16+00:00
  • kernel-64k-debug-debuginfo-0:5.14.0-687.55.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_8?arch=aarch64

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Red Hat recommends treating all kernel errata as security-relevant. Given the kernel's fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers' overall security posture. Because of this proactive approach, a patch may be associated with a CVE assignment at a future date. Retroactive CVE assignments are always documented in the corresponding errata and on Red Hat's CVE pages. We strongly advise against delaying updates, as doing so may leave your system exposed when protections are already available. Vendor guidance
    Red Hat · CVE-2026-74569 · Updated 2026-10-08T21:17:16+00:00
  • kernel-0:6.12.0-211.59.1.el10_2.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 10) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_2?arch=aarch64

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Red Hat recommends treating all kernel errata as security-relevant. Given the kernel's fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers' overall security posture. Because of this proactive approach, a patch may be associated with a CVE assignment at a future date. Retroactive CVE assignments are always documented in the corresponding errata and on Red Hat's CVE pages. We strongly advise against delaying updates, as doing so may leave your system exposed when protections are already available. Vendor guidance
    Red Hat · CVE-2026-74569 · Updated 2026-10-08T21:17:16+00:00
  • kernel-rt-debuginfo-0:6.12.0-211.59.1.el10_2.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 10) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_2?arch=x86_64

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Red Hat recommends treating all kernel errata as security-relevant. Given the kernel's fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers' overall security posture. Because of this proactive approach, a patch may be associated with a CVE assignment at a future date. Retroactive CVE assignments are always documented in the corresponding errata and on Red Hat's CVE pages. We strongly advise against delaying updates, as doing so may leave your system exposed when protections are already available. Vendor guidance
    Red Hat · CVE-2026-74569 · Updated 2026-10-08T21:17:16+00:00
  • kernel-debuginfo-0:4.18.0-553.171.1.el8_10.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 8) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_10?arch=aarch64

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Red Hat recommends treating all kernel errata as security-relevant. Given the kernel's fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers' overall security posture. Because of this proactive approach, a patch may be associated with a CVE assignment at a future date. Retroactive CVE assignments are always documented in the corresponding errata and on Red Hat's CVE pages. We strongly advise against delaying updates, as doing so may leave your system exposed when protections are already available. Vendor guidance
    Red Hat · CVE-2026-74569 · Updated 2026-10-08T21:17:16+00:00
  • kernel-debug-0:5.14.0-687.55.1.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_8?arch=aarch64

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Red Hat recommends treating all kernel errata as security-relevant. Given the kernel's fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers' overall security posture. Because of this proactive approach, a patch may be associated with a CVE assignment at a future date. Retroactive CVE assignments are always documented in the corresponding errata and on Red Hat's CVE pages. We strongly advise against delaying updates, as doing so may leave your system exposed when protections are already available. Vendor guidance
    Red Hat · CVE-2026-74569 · Updated 2026-10-08T21:17:16+00:00
  • perf-debuginfo-0:5.14.0-687.55.1.el9_8.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 9) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_8?arch=x86_64

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Red Hat recommends treating all kernel errata as security-relevant. Given the kernel's fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers' overall security posture. Because of this proactive approach, a patch may be associated with a CVE assignment at a future date. Retroactive CVE assignments are always documented in the corresponding errata and on Red Hat's CVE pages. We strongly advise against delaying updates, as doing so may leave your system exposed when protections are already available. Vendor guidance
    Red Hat · CVE-2026-74569 · Updated 2026-10-08T21:17:16+00:00
  • kernel-debug-debuginfo-0:5.14.0-687.55.1.el9_8.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_8?arch=ppc64le

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Red Hat recommends treating all kernel errata as security-relevant. Given the kernel's fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers' overall security posture. Because of this proactive approach, a patch may be associated with a CVE assignment at a future date. Retroactive CVE assignments are always documented in the corresponding errata and on Red Hat's CVE pages. We strongly advise against delaying updates, as doing so may leave your system exposed when protections are already available. Vendor guidance
    Red Hat · CVE-2026-74569 · Updated 2026-10-08T21:17:16+00:00
  • kernel-rt-modules-0:4.18.0-553.171.1.rt7.512.el8_10.x86_64 as a component of Red Hat Enterprise Linux NFV (v. 8) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_10?arch=x86_64

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Red Hat recommends treating all kernel errata as security-relevant. Given the kernel's fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers' overall security posture. Because of this proactive approach, a patch may be associated with a CVE assignment at a future date. Retroactive CVE assignments are always documented in the corresponding errata and on Red Hat's CVE pages. We strongly advise against delaying updates, as doing so may leave your system exposed when protections are already available. Vendor guidance
    Red Hat · CVE-2026-74569 · Updated 2026-10-08T21:17:16+00:00
  • libperf-debuginfo-0:6.12.0-211.59.1.el10_2.x86_64 as a component of Red Hat Enterprise Linux Real Time (v. 10) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_2?arch=x86_64

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Red Hat recommends treating all kernel errata as security-relevant. Given the kernel's fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers' overall security posture. Because of this proactive approach, a patch may be associated with a CVE assignment at a future date. Retroactive CVE assignments are always documented in the corresponding errata and on Red Hat's CVE pages. We strongly advise against delaying updates, as doing so may leave your system exposed when protections are already available. Vendor guidance
    Red Hat · CVE-2026-74569 · Updated 2026-10-08T21:17:16+00:00
  • python3-perf-debuginfo-0:5.14.0-687.55.1.el9_8.x86_64 as a component of Red Hat Enterprise Linux Real Time (v. 9) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_8?arch=x86_64

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Red Hat recommends treating all kernel errata as security-relevant. Given the kernel's fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers' overall security posture. Because of this proactive approach, a patch may be associated with a CVE assignment at a future date. Retroactive CVE assignments are always documented in the corresponding errata and on Red Hat's CVE pages. We strongly advise against delaying updates, as doing so may leave your system exposed when protections are already available. Vendor guidance
    Red Hat · CVE-2026-74569 · Updated 2026-10-08T21:17:16+00:00
  • bpftool as a component of Red Hat Enterprise Linux 7 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/bpftool

    • none available: Affected
    Red Hat · CVE-2026-74569 · Updated 2026-10-08T21:17:16+00:00
  • kernel-debug-devel as a component of Red Hat Enterprise Linux 7 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/kernel-debug-devel

    • none available: Affected
    Red Hat · CVE-2026-74569 · Updated 2026-10-08T21:17:16+00:00
  • kernel-kdump-devel as a component of Red Hat Enterprise Linux 7 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/kernel-kdump-devel

    • none available: Affected
    Red Hat · CVE-2026-74569 · Updated 2026-10-08T21:17:16+00:00
  • kernel-rt-devel as a component of Red Hat Enterprise Linux 7 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/kernel-rt-devel

    • none available: Affected
    Red Hat · CVE-2026-74569 · Updated 2026-10-08T21:17:16+00:00
  • kernel-rt-trace-kvm as a component of Red Hat Enterprise Linux 7 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/kernel-rt-trace-kvm

    • none available: Affected
    Red Hat · CVE-2026-74569 · Updated 2026-10-08T21:17:16+00:00
  • kernel-tools-libs-devel as a component of Red Hat Enterprise Linux 7 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/kernel-tools-libs-devel

    • none available: Affected
    Red Hat · CVE-2026-74569 · Updated 2026-10-08T21:17:16+00:00
  • kernel-rt-core as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/kernel-rt-core

    • none available: Affected
    Red Hat · CVE-2026-74569 · Updated 2026-10-08T21:17:16+00:00
  • kernel-rt-debug-kvm as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/kernel-rt-debug-kvm

    • none available: Affected
    Red Hat · CVE-2026-74569 · Updated 2026-10-08T21:17:16+00:00
  • kernel-rt-debug-modules-partner as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/kernel-rt-debug-modules-partner

    • none available: Affected
    Red Hat · CVE-2026-74569 · Updated 2026-10-08T21:17:16+00:00
  • kernel-rt-modules-core as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/kernel-rt-modules-core

    • none available: Affected
    Red Hat · CVE-2026-74569 · Updated 2026-10-08T21:17:16+00:00
  • kernel-rt.src as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/kernel-rt?arch=src

    • none available: Affected
    Red Hat · CVE-2026-74569 · Updated 2026-10-08T21:17:16+00:00
  • kernel as a component of Red Hat Enterprise Linux 6 · under investigation

    Vendor assessment for this product only.

    pkg:rpm/redhat/kernel

    Red Hat · CVE-2026-74569 · Updated 2026-10-08T21:17:16+00:00
  • kernel-abi-whitelists as a component of Red Hat Enterprise Linux 6 · under investigation

    Vendor assessment for this product only.

    pkg:rpm/redhat/kernel-abi-whitelists

    Red Hat · CVE-2026-74569 · Updated 2026-10-08T21:17:16+00:00
  • kernel-debug as a component of Red Hat Enterprise Linux 6 · under investigation

    Vendor assessment for this product only.

    pkg:rpm/redhat/kernel-debug

    Red Hat · CVE-2026-74569 · Updated 2026-10-08T21:17:16+00:00
  • kernel-debug-devel as a component of Red Hat Enterprise Linux 6 · under investigation

    Vendor assessment for this product only.

    pkg:rpm/redhat/kernel-debug-devel

    Red Hat · CVE-2026-74569 · Updated 2026-10-08T21:17:16+00:00
  • kernel-doc as a component of Red Hat Enterprise Linux 6 · under investigation

    Vendor assessment for this product only.

    pkg:rpm/redhat/kernel-doc

    Red Hat · CVE-2026-74569 · Updated 2026-10-08T21:17:16+00:00
  • kernel-firmware as a component of Red Hat Enterprise Linux 6 · under investigation

    Vendor assessment for this product only.

    pkg:rpm/redhat/kernel-firmware

    Red Hat · CVE-2026-74569 · Updated 2026-10-08T21:17:16+00:00
  • kernel-kdump as a component of Red Hat Enterprise Linux 6 · under investigation

    Vendor assessment for this product only.

    pkg:rpm/redhat/kernel-kdump

    Red Hat · CVE-2026-74569 · Updated 2026-10-08T21:17:16+00:00
  • kernel-kdump-devel as a component of Red Hat Enterprise Linux 6 · under investigation

    Vendor assessment for this product only.

    pkg:rpm/redhat/kernel-kdump-devel

    Red Hat · CVE-2026-74569 · Updated 2026-10-08T21:17:16+00:00
  • perf as a component of Red Hat Enterprise Linux 6 · under investigation

    Vendor assessment for this product only.

    pkg:rpm/redhat/perf

    Red Hat · CVE-2026-74569 · Updated 2026-10-08T21:17:16+00:00
  • python-perf as a component of Red Hat Enterprise Linux 6 · under investigation

    Vendor assessment for this product only.

    pkg:rpm/redhat/python-perf

    Red Hat · CVE-2026-74569 · Updated 2026-10-08T21:17:16+00:00

All CVSS metrics

  • CRITICAL 9.8 v3.1 · CNA Primary
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  • CRITICAL 9.8 v3.1 · NVD Secondary
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Advisories

Technical & other

Sources: NVD · CVE.org · All sources and attribution · EPSS