What is the CVSS score of CVE-2026-72253?

CVE-2026-72253 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-72253?

A Linux kernel vulnerability affecting SIP communication routing can trigger unplanned system crashes on infrastructure configured with specific network stacks.. A patch is available.

How to fix or mitigate CVE-2026-72253?

Within 24 hours, audit infrastructure for Linux systems running OpenVSwitch or tc-based ingress with the sip_external_media module parameter active-these systems face crash risk. Within 7 days, test kernel patches from your Linux vendor in non-production environments and develop a patching schedule for affected systems. Complete production patching within 30 days; meanwhile, disable the sip_external_media=1 parameter on systems that cannot patch immediately.

Linux Kernel CVE-2026-72253

EUVD-2026-59152 HIGH

2026-08-15 416baaa9-dc9f-4396-8d5f-8c081fb06d67

GHSA-7j9w-2xg9-r3v4

Denial Of Service Linux Suse

7.5

CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

5.9 MEDIUM

AC:H reflects the non-default sip_external_media=1 requirement combined with the OVS/tc ingress topology prerequisite; no confidentiality or integrity impact applies.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

5.9 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Red Hat

7.0 MEDIUM

qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 07:59 vuln.today

CVSS changed

Aug 17, 2026 - 06:22 NVD

7.5 (HIGH)

Patch available

Aug 15, 2026 - 07:20 EUVD

CVE Published

Aug 15, 2026 - 06:21 cve.org

HIGH 7.5

CVE Published

Aug 15, 2026 - 06:21 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_conntrack_sip: validate skb_dst() before accessing it

tc ingress and openvswitch do not guarantee routing information to be available. These subsystems use the conntrack helper infrastructure, and the SIP helper relies on the skb_dst() to be present if sip_external_media is set to 1 (which is disabled by default as a module parameter).

This effectively disables the sip_external_media toggle for these subsystems without resulting in a crash.

AnalysisAI

Null pointer dereference in the Linux kernel's netfilter SIP connection tracking helper (nf_conntrack_sip) can crash the kernel when the non-default sip_external_media=1 module parameter is active and SIP traffic traverses tc ingress or OpenVSwitch paths. Successful exploitation causes a complete availability loss (kernel panic/crash), satisfying the CVSS A:H rating. No public exploit code has been identified and EPSS sits at the 11th percentile, indicating low observed exploitation activity despite the high base score.

Technical ContextAI

The Linux kernel's netfilter subsystem includes nf_conntrack_sip, a connection tracking helper for SIP (Session Initiation Protocol) that inspects and rewrites SIP signalling to handle NAT traversal. The helper optionally tracks external media endpoints when the sip_external_media module parameter is set to 1. In this mode, the code accesses the socket buffer's destination routing entry via skb_dst(), assuming it is always populated. However, tc (traffic control) ingress hooks and OpenVSwitch (OVS) do not guarantee that routing information is attached to the skb - a valid operating condition for those subsystems. This missing pre-condition validation constitutes a CWE-476 (NULL Pointer Dereference)-class flaw: when a SIP packet processed by these subsystems reaches the helper with sip_external_media enabled, dereferencing the NULL skb_dst() triggers a kernel oops or panic. The fix adds an explicit NULL check before the access, and as a side effect silently disables the sip_external_media logic for tc ingress and OVS paths.

RemediationAI

The primary fix is to upgrade to a patched Linux kernel version: 6.6.148 or later for the 6.6.x LTS branch, 6.12.101 or later for the 6.12.x LTS branch, 6.18.42 or later for the 6.18.x branch, or 7.1.5 or later for the 7.1.x branch. Stable kernel patches are available at the git.kernel.org references listed above. For systems where an immediate kernel upgrade is not feasible, the most effective compensating control is to ensure the sip_external_media module parameter remains at its default value of 0 - verify with 'cat /sys/module/nf_conntrack_sip/parameters/sip_external_media'. If it is set to 1, remove it from /etc/modprobe.d/ configurations and reload the module; this eliminates the vulnerable code path entirely and has no impact on SIP NAT traversal for standard iptables/nftables environments. Systems not using tc ingress or OpenVSwitch for SIP traffic are not exposed even with the parameter set, but patching remains recommended.

Same technique Denial Of Service

View all

CVE-2015-5119 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2011-0611 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

CVE-2012-0507 CRITICAL POC

9.8

CVE-2014-1761 HIGH POC

7.8

CVE-2015-5122 CRITICAL POC

9.8

CVE-2011-0609 HIGH POC

7.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

CVE-2026-72253 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-72253

Severity by source

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Denial Of Service

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code