CVE-2026-72253

HighCVSS 7.5

Published: 15/08/2026(UTC)Updated: 23/08/2026(UTC)Translated: 15/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.60%

46th percentile - higher than 46% of all known CVEs

Summary

In the Linux kernel, the nf_conntrack_sip netfilter module lacks validation of skb_dst() before accessing it. When routing information is unavailable (e.g., in tc ingress or openvswitch), a crash may occur.

Risk Assessment

Using the SIP helper in environments without routing (tc ingress, openvswitch) can lead to a system crash if the sip_external_media option is enabled.

Recommendation

Apply a Linux kernel update containing the fix that adds validation of skb_dst() before accessing it.

Original NVD description (English source)

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_sip: validate skb_dst() before accessing it tc ingress and openvswitch do not guarantee routing information to be available. These subsystems use the conntrack helper infrastructure, and the SIP helper relies on the skb_dst() to be present if sip_external_media is set to 1 (which is disabled by default as a module parameter). This effectively disables the sip_external_media toggle for these subsystems without resulting in a crash.