CVE-2026-98077

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace()

sip_skip_whitespace() returns dptr unchanged when its own loop

exhausts the buffer (dptr == limit), instead of NULL like its sibling

sip_follow_continuation() returns on its own "no more data" path.

ct_sip_get_header() only checks for NULL after calling it:

dptr = sip_skip_whitespace(dptr, limit);

if (dptr == NULL)

break;

if (*dptr != ':' || ++dptr >= limit)

break;

so a recognized header name followed only by spaces/tabs running to

the exact end of the SIP payload, with no colon, makes the very next

statement read one byte past the buffer.

Make both "no more data" outcomes return NULL, matching the

convention sip_follow_continuation() already uses and that both

existing callers already check for.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References