Linux Kernel EUVD-2026-87067

Requires the Linux system to be acting as a NAT gateway with the SIP application-layer gateway helper (nf_conntrack_sip/nf_nat_sip) loaded and processing SIP traffic - this module is NOT loaded in default configurations of most deployments. The specific trigger is a SIP message traversing NAT where map_addr() shrinks the packet (the public NAT IP string is shorter than the internal IP) AND the message contains additional Contact headers after the mangled one; only then does the stale coff offset overshoot and cause later headers to be skipped. Limiting factors: the SIP ALG must be explicitly enabled, the IP-string-length relationship must cause shrinkage, multiple Contact headers must be present, and the consequence is at most disclosure of internal addressing rather than code execution or service disruption.

This is a low-priority, medium-severity issue despite the generic CVSS 5.5 rating. Multiple signals converge on low real-world risk: EPSS is just 0.17% (5th percentile), there is no CISA KEV listing (no public exploit identified at time of analysis), and no public proof-of-concept is referenced - the only sources are kernel.org stable commits and tracker advisories (VulDB, NVD, EUVD). Importantly, the input signals CONFLICT: the provided CVSS vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (local vector, authenticated, pure availability impact), yet the description and the 'Information Disclosure' tag describe a network-processing flaw in the SIP NAT ALG that could leak internal IP addresses - a confidentiality impact, not availability, and triggered by remote SIP traffic rather than local access. This A:H-with-C:N/I:N labeling is characteristic of the Linux kernel CNA's bulk auto-assignment and should not be treated as an authoritative impact analysis. The description itself frames impact as an open question ('Could this lead to a failure to NAT... and leak internal network details?'), so even information disclosure is a plausible hypothesis rather than a confirmed consequence. Verify actual impact (info-leak vs. none) with the upstream commit before prioritizing.

A Linux host acting as a NAT/firewall gateway with the SIP connection-tracking/NAT helper (nf_nat_sip) active rewrites SIP payloads as they traverse NAT. When the substituted public IP string is shorter than the internal IP, the packet shrinks and a stale offset causes subsequent Contact headers to be skipped and left un-translated, potentially exposing internal (RFC 1918) addresses to the external peer. No public exploit code is identified; realistic triggering requires SIP traffic matching specific IP-string-length and multi-header conditions.