Skip to main content

Linux Kernel EUVDEUVD-2026-38870

| CVE-2026-53002 CRITICAL
Out-of-bounds Write (CWE-787)
2026-06-24 Linux GHSA-2256-5c36-mwcj
Buffer Overflow Linux Memory Corruption
Critical
Disputed · 9.8 Vendor: Linux
Share

Severity by source

Sources disagree (Medium–Critical)
Vendor (Linux) PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
6.5 MEDIUM

Remotely triggered (AV:N) but only with the SIP conntrack/NAT helper enabled and a crafted SDP (AC:H); a one-byte stack overflow primarily yields DoS (A:H) with limited integrity impact and no clear disclosure.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
7.0 HIGH
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jun 28, 2026 - 08:47 vuln.today
CVSS changed
Jun 28, 2026 - 08:22 NVD
9.8 (CRITICAL)
Patch available
Jun 24, 2026 - 18:02 EUVD
CVE Published
Jun 24, 2026 - 16:29 cve.org
CRITICAL 9.8
CVE Published
Jun 24, 2026 - 16:29 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

netfilter: conntrack: remove sprintf usage

Replace it with scnprintf, the buffer sizes are expected to be large enough to hold the result, no need for snprintf+overflow check.

Increase buffer size in mangle_content_len() while at it.

BUG: KASAN: stack-out-of-bounds in vsnprintf+0xea5/0x1270 Write of size 1 at addr [..] vsnprintf+0xea5/0x1270 sprintf+0xb1/0xe0 mangle_content_len+0x1ac/0x280 nf_nat_sdp_session+0x1cc/0x240 process_sdp+0x8f8/0xb80 process_invite_request+0x108/0x2b0 process_sip_msg+0x5da/0xf50 sip_help_tcp+0x45e/0x780 nf_confirm+0x34d/0x990 [..]

AnalysisAI

Stack out-of-bounds write in the Linux kernel's netfilter connection-tracking SIP application-layer gateway (ALG) allows remote attackers to corrupt kernel stack memory by sending crafted SIP/SDP traffic through a NAT device. The flaw lives in mangle_content_len(), reached via nf_nat_sdp_session → process_sdp when rewriting the SDP Content-Length during SIP INVITE handling, where an unbounded sprintf() overflowed an undersized stack buffer (caught by KASAN). There is no public exploit identified at time of analysis and EPSS is low (0.18%), so despite the NVD 9.8 rating the practical risk is gated by whether the SIP conntrack/NAT helper is in use.

Technical ContextAI

The affected component is netfilter's SIP connection-tracking and NAT helper (nf_conntrack_sip / nf_nat_sip), which performs deep inspection and payload mangling of SIP signaling so that embedded SDP media addresses and Content-Length headers stay consistent after NAT translation. The root cause is a classic unbounded-format-string-to-fixed-buffer pattern (CWE-787 out-of-bounds write / CWE-121 stack buffer overflow, though the CVE lists CWE as N/A): mangle_content_len() used sprintf() to render an integer into a stack buffer that was too small, producing a one-byte stack-out-of-bounds write detected by KASAN in vsnprintf. The fix replaces sprintf with the bounded scnprintf and enlarges the destination buffer. The CPE data (cpe:2.3:a:linux:linux:*) only generically identifies the Linux kernel; the actual exposure is limited to kernels with the SIP ALG compiled and loaded.

RemediationAI

Vendor-released patch: upgrade to a fixed stable kernel for your series - 5.10.258, 5.15.209, 6.1.175, 6.6.141, 6.12.91, 6.18.33, or 7.0.10 (or later), or apply the corresponding distribution kernel update once it ships the referenced commits (https://git.kernel.org/stable/c/2f793ba78470a99f40389b7dc60a81d9f5ad3956 and the related stable backports). If you cannot patch immediately, the most effective compensating control is to disable the SIP application-layer helper so the vulnerable mangle_content_len() path is never reached: unload/blacklist the nf_conntrack_sip and nf_nat_sip modules, or for in-tree builds set the helper off (e.g. sysctl net.netfilter.nf_conntrack_helper=0 and remove explicit SIP CT helper rules) - the trade-off is that SIP through stateful NAT may break for VoIP clients that relied on the ALG, which typically must then be reconfigured to use a SBC/STUN/TURN or static port forwarding. Alternatively, restrict or block untrusted SIP (default UDP/TCP 5060) traffic from traversing the affected NAT/firewall host until patched.

Same weakness CWE-787 – Out-of-bounds Write

View all
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2012-1889 HIGH POC
8.8
CVE-2010-3333 HIGH POC
7.8
CVE-2014-1761 HIGH POC
7.8
CVE-2009-3129 HIGH POC
7.8
CVE-2021-1732 HIGH POC
7.8
CVE-2013-3346 CRITICAL POC
9.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

EUVD-2026-38870 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy