netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace() (CVE-2026-98077) | HOL Guard CVE

Unknown severity · Source severity not reportedCVE-2026-98077

netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace()

Answer in brief

CVE-2026-98077 records a Unknown severity vulnerability in netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace(). The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.

Analysis pending evidence review

HOL Guard separates source facts from reviewed analysis. See the methodology.

Published Sep 25, 2026Updated Sep 25, 2026Source checked Sep 25, 2026First seen by HOL Sep 25, 2026Material review Sep 25, 2026

Upstream Advisory

Key facts

Risk: Unknown severitySource severity not reported
Exploitation: Not marked as known exploited
Affected software: 2 mapped packages or products
Fix availability: Available

Why this deserves its current priority

A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
Linux/Linuxgeneric	>=ea45f12a2766dae54e5426a23e8f4bafdbe2782e <60c012b2d05e1558b0f30ea3f15a2c3ca2f24d94 \|\| >=ea45f12a2766dae54e5426a23e8f4bafdbe2782e <4be8380e3af008f418f97992c06f23be649a430d \|\| >=ea45f12a2766dae54e5426a23e8f4bafdbe2782e <4a30aa2ba007db18210dd52219ecbd5528c03523 \|\| >=ea45f12a2766dae54e5426a23e8f4bafdbe2782e <e8f8231824b5815f57ce62cba116e511b10196de	60c012b2d05e1558b0f30ea3f15a2c3ca2f24d94, 4be8380e3af008f418f97992c06f23be649a430d, 4a30aa2ba007db18210dd52219ecbd5528c03523, e8f8231824b5815f57ce62cba116e511b10196de
Linux/Linuxgeneric	2.6.26	Not reported

Recommended response

Check inventory. Check lockfiles and deployed manifests for Linux/Linux, Linux/Linux.
Review the reported fix. Update Linux/Linux to 60c012b2d05e1558b0f30ea3f15a2c3ca2f24d94 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

Published upstream
Sep 25, 2026
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Sep 25, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Sep 25, 2026

Sources and claim methodology

Upstream source description

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace() sip_skip_whitespace() returns dptr unchanged when its own loop exhausts the buffer (dptr == limit), instead of NULL like its sibling sip_follow_continuation() returns on its own "no more data" path. ct_sip_get_header() only checks for NULL after calling it: dptr = sip_skip_whitespace(dptr, limit); if (dptr == NULL) break; if (*dptr != ':' || ++dptr >= limit) break; so a recognized header name followed only by spaces/tabs running to the exact end of the SIP payload, with no colon, makes the very next statement read one byte past the buffer. Make both "no more data" outcomes return NULL, matching the convention sip_follow_continuation() already uses and that both existing callers already check for.

Quoted source text, attributed separately from HOL analysis.