Linux EUVD-2026-18714

The vulnerability exists in the netfilter nf_conntrack_sip module, which implements stateful SIP (Session Initiation Protocol) connection tracking for the Linux kernel firewall. The vulnerable code path is sip_help_tcp(), which parses SIP protocol headers to track connection state. SIP is a text-based signaling protocol used in VoIP and multimedia communications; the Content-Length header specifies the size of the message body. The root cause is a type mismatch: simple_strtoul() returns unsigned long (64 bits on 64-bit architectures), but the result is assigned to unsigned int (always 32 bits), causing implicit truncation. For example, Content-Length 4,294,967,328 (2^32 + 32) truncates to 32 bytes. This causes sip_help_tcp() to compute an incorrect message boundary offset, leading the connection tracking loop to misinterpret trailing TCP payload data as a separate SIP message, which is then processed by the SDP (Session Description Protocol) parser. The issue is classified as information disclosure, suggesting that parsing malformed SDP content can leak kernel memory or reveal protocol handler state.