What is the CVSS score of CVE-2026-74569?

CVE-2026-74569 has a contested CVSS base score of 9.8 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Linux Kernel are affected by CVE-2026-74569?

CVE-2026-74569 is a critical out-of-bounds memory read vulnerability in the Linux kernel's SIP connection-tracking module affecting systems performing SIP NAT rewriting.. A patch is available.

How to fix or mitigate CVE-2026-74569?

Within 24 hours, identify and inventory all Linux systems with active SIP NAT rewriting functionality (typically VoIP gateways, SIP proxies, or session border controllers running nf_conntrack_sip). Within 7 days, obtain the vendor-released patch from your Linux distribution (Red Hat, Canonical, Debian, etc.) and deploy to production systems after validation in a test environment, prioritizing communication-critical infrastructure. Within 30 days, complete patching across all affected systems, verify deployment via kernel version audits, and validate SIP traffic handling to confirm DOS resilience.

Linux Kernel CVE-2026-74569

EUVD-2026-59634 CRITICAL

2026-08-15 Linux

GHSA-jjgj-x6vq-56wx

Information Disclosure Linux Red Hat Suse

Critical

Disputed · 9.8 Vendor: Linux

Severity by source

Sources disagree (Medium–Critical)

Vendor (Linux) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

6.5 MEDIUM

Remotely reachable via forwarded SIP but needs the non-default SIP helper plus a message engineered to overflow s16 (AC:H); impact is an out-of-bounds read causing crash (A:H) and possible memory leak (C:L), not integrity.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Red Hat

7.0 HIGH

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 12:32 vuln.today

CVSS changed

Aug 17, 2026 - 06:22 NVD

9.8 (CRITICAL)

Patch available

Aug 15, 2026 - 13:04 EUVD

CVE Published

Aug 15, 2026 - 12:28 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 15, 2026 - 12:28 cve.org

CRITICAL 9.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp()

sip_help_tcp() stores the size change of each NAT-rewritten SIP message in s16 diff and accumulates it in s16 tdiff, but a single message can grow by more than S16_MAX while the packet stays under the 65535 enlarge_skb() limit: nf_nat_sip() rewrites every matching URI, and a long Contact list expands the message by tens of kilobytes. diff then wraps, and "datalen = datalen + diff - msglen" yields a huge unsigned datalen, so the next iteration's ct_sip_get_header() reads past the linearized skb tail.

Widen diff, tdiff and the seq_adjust hook to s32. Both are bounded by the 65535 byte packet limit, and the seqadj core is already s32 (nf_ct_seqadj_set() takes s32), so no previously accepted input is rejected.

BUG: KASAN: use-after-free in ct_sip_get_header (net/netfilter/nf_conntrack_sip.c:464) Read of size 1 at addr ffff888010800000 by task ksoftirqd/1/25 ct_sip_get_header (net/netfilter/nf_conntrack_sip.c:464) sip_help_tcp (net/netfilter/nf_conntrack_sip.c:1694) nf_confirm (net/netfilter/nf_conntrack_proto.c:183) nf_hook_slow (net/netfilter/core.c:619) ip6_output (net/ipv6/ip6_output.c:246) ip6_forward (net/ipv6/ip6_output.c:690) ipv6_rcv (net/ipv6/ip6_input.c:351) __netif_receive_skb_one_core (net/core/dev.c:6212) process_backlog (net/core/dev.c:6676) __napi_poll (net/core/dev.c:7735) net_rx_action (net/core/dev.c:7955) handle_softirqs (kernel/softirq.c:622) run_ksoftirqd (kernel/softirq.c:1076) ...

AnalysisAI

Out-of-bounds kernel memory read in the Linux netfilter SIP connection-tracking helper (nf_conntrack_sip) lets remote attackers crash or leak memory from any host doing SIP NAT rewriting. When sip_help_tcp() NAT-rewrites a SIP message, the per-message size delta is stored in a signed 16-bit variable; a single message with a long Contact list can grow by more than S16_MAX (while still under the 65535 enlarge_skb limit), wrapping the counter so datalen underflows to a huge unsigned value and ct_sip_get_header() reads past the linearized skb tail (KASAN use-after-free). …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Send crafted SIP-over-TCP through NAT gateway

Delivery

nf_nat_sip rewrites long Contact URI list

Exploit

s16 diff accumulates past S16_MAX and wraps

Execution

datalen underflows to huge unsigned value

Persist

ct_sip_get_header reads past skb tail

Impact

kernel use-after-free crash or memory leak

Access

Send crafted SIP-over-TCP through NAT gateway

Delivery

nf_nat_sip rewrites long Contact URI list

Exploit

s16 diff accumulates past S16_MAX and wraps

Execution

datalen underflows to huge unsigned value

Persist

ct_sip_get_header reads past skb tail

Impact

kernel use-after-free crash or memory leak

Vulnerability AssessmentAI

Exploitation	Requires the target Linux host to be running the nf_conntrack_sip helper AND performing SIP NAT rewriting (nf_nat_sip) on forwarded SIP-over-TCP traffic - i.e. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The NVD-style CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) substantially overstates real-world risk and conflicts with the other signals. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker sends a crafted SIP INVITE or REGISTER over TCP through a Linux NAT gateway that has the SIP ALG helper active, packing the message with a long Contact/URI list so that NAT rewriting expands it by more than 32 KB while keeping the packet under 65535 bytes. The s16 delta wraps, datalen underflows, and the kernel's SIP parser reads past the skb tail in softirq context - crashing the box (denial of service) or potentially leaking adjacent kernel memory. …
Remediation	Vendor-released patch: upgrade to a fixed stable kernel - 6.18.44, 6.12.103, 6.6.151, or 7.1.8 (fix also in 7.2-rc6) or later on the corresponding branch, or apply your distribution's backport of the git.kernel.org stable commits (63eea41759fd, c97621a110e3, f74554e67ccf, ef5e2c6555d2, db3d0e0e5d4b). … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, identify and inventory all Linux systems with active SIP NAT rewriting functionality (typically VoIP gateways, SIP proxies, or session border controllers running nf_conntrack_sip). …

Threat intelligence, references, and detailed analysis are available after sign-in.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

CVE-2026-74569 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-74569

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Unlock full vulnerability intelligence

Attack ChainAIDerived

Vulnerability AssessmentAI

Recommended ActionAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code