9.8

CVE-2026-74569: linux

CVSS: 9.8v3.1CriticalReceived
AliasesUBUNTU-CVE-2026-74569DEBIAN-CVE-2026-74569
Published 15-08-2026Last modified 16-10-2026
Open JSON

Vulnerability summary

CVE-2026-74569 is a critical (CVSS 9.8) vulnerability in linux. EPSS estimates a 0.39% chance of exploitation in the next 30 days, higher than 31.4% of scored vulnerabilities.

Overall risk
70/100
0100
High · default modelHow is this calculated?
CVSS score
9.8/10
010
Critical · v3.1 (CVE.org)
EPSS score
0.39%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 11 · Related 7
RHSA-2026:71233RHSA-2026:75746RHSA-2026:75747RHSA-2026:76739USN-8781-1USN-8875-1

Timeline

  1. 15-08-2026
    PublishedVulnerability first disclosed.
  2. 16-10-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() sip_help_tcp() stores the size change of each NAT-rewritten SIP message in s16 diff and accumulates it in s16 tdiff, but a single message can grow by more than S16_MAX while the packet stays under the 65535 enlarge_skb() limit: nf_nat_sip() rewrites every matching URI, and a long Contact list expands the message by tens of kilobytes. diff then wraps, and "datalen = datalen + diff - msglen" yields a huge unsigned datalen, so the next iteration's ct_sip_get_header() reads past the linearized skb tail. Widen diff, tdiff and the seq_adjust hook to s32. Both are bounded by the 65535 byte packet limit, and the seqadj core is already s32 (nf_ct_seqadj_set() takes s32), so no previously accepted input is rejected. BUG: KASAN: use-after-free in ct_sip_get_header (net/netfilter/nf_conntrack_sip.c:464) Read of size 1 at addr ffff888010800000 by task ksoftirqd/1/25 ct_sip_get_header (net/netfilter/nf_conntrack_sip.c:464) sip_help_tcp (net/netfilter/nf_conntrack_sip.c:1694) nf_confirm (net/netfilter/nf_conntrack_proto.c:183) nf_hook_slow (net/netfilter/core.c:619) ip6_output (net/ipv6/ip6_output.c:246) ip6_forward (net/ipv6/ip6_output.c:690) ipv6_rcv (net/ipv6/ip6_input.c:351) __netif_receive_skb_one_core (net/core/dev.c:6212) process_backlog (net/core/dev.c:6676) __napi_poll (net/core/dev.c:7735) net_rx_action (net/core/dev.c:7955) handle_softirqs (kernel/softirq.c:622) run_ksoftirqd (kernel/softirq.c:1076) ...

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

0.39%

Chance of exploitation in the next 30 days

Percentile

31%

Versus all other CVEs

30-day change

0.00 pp

From 0.39% on 20-09-2026

20-09-202620-10-2026
EPSS score
0.39%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Ubuntu169 products
  • linuxAll versions (No fix recorded) | < 5.15.0-198.208
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded) | < 5.15.0-1117.124
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Debian2 products
  • linux< 6.1.187-1 | < 6.12.105-1 | < 7.1.8-1
  • linux-6.12< 6.12.107-1~deb12u1
Linux1 product
  • linux≥ f5b321bd37fbec9188feb1f721ab46a5ac0b35da, < ed1f9be6dc8e2e280b8725e44ccdc6e0cd38640d | ≥ f5b321bd37fbec9188feb1f721ab46a5ac0b35da, < 1b0843f9e9b9b0b9b4b70d143b67e58163c85b2c | ≥ f5b321bd37fbec9188feb1f721ab46a5ac0b35da, < 32d4abc8923b0d4046fd63ad6e4917872e44eb6d | ≥ f5b321bd37fbec9188feb1f721ab46a5ac0b35da, < 63eea41759fd682229c14e0a2205802b46d106f3 | ≥ f5b321bd37fbec9188feb1f721ab46a5ac0b35da, < c97621a110e386b2dd69e276eb699e1d3cec581d | ≥ f5b321bd37fbec9188feb1f721ab46a5ac0b35da, < f74554e67ccf04d1fa71069e8c9afa2717e40716 | ≥ f5b321bd37fbec9188feb1f721ab46a5ac0b35da, < ef5e2c6555d2bb52dfe0e4053a8c6193f9d83b64 | ≥ f5b321bd37fbec9188feb1f721ab46a5ac0b35da, < db3d0e0e5d4bc5ab4fe445b9f413d1b486508ca5 | 2.6.34

3 vendors · 172 products

References

20 links
Show all 20 references