CVE-2026-23457

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() sip_help_tcp() parses the SIP Content-Length header with simple_strtoul(), which returns unsigned long, but stores the result in unsigned int clen. On 64-bit systems, values exceeding UINT_MAX are silently truncated before computing the SIP message boundary. For example, Content-Length 4294967328 (2^32 + 32) is truncated to 32, causing the parser to miscalculate where the current message ends. The loop then treats trailing data in the TCP segme...

Affected product and versions

Product

Linux Linux, SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP

Affected versions

>= f5b321bd37fbec9188feb1f721ab46a5ac0b35da < ed81b6a7012485acdb9c6c80735a0b7d8e5e1873, >= f5b321bd37fbec9188feb1f721ab46a5ac0b35da < cd1b7403ec835f8a0b3f1f7e68ac26af2cb1e42f, >= f5b321bd37fbec9188feb1f721ab46a5ac0b35da < b75209debb9adab287b3caa982f77788c1e15027, >= f5b321bd37fbec9188feb1f721ab46a5ac0b35da < 528b4509c9dfc272e2e92d811915e5211650d383, >= f5b321bd37fbec9188feb1f721ab46a5ac0b35da < 75fcaee5170e7dbbee778927134ef2e9568b4659, >= f5b321bd37fbec9188feb1f721ab46a5ac0b35da < 865dba58958c3a86786f89a501971ab0e3ec6ba9, >= f5b321bd37fbec9188feb1f721ab46a5ac0b35da < d4f17256544cc37f6534a14a27a9dec3540c2015, >= f5b321bd37fbec9188feb1f721ab46a5ac0b35da < fbce58e719a17aa215c724473fd5baaa4a8dc57c, >= 2.6.34, >= V3.1.6, >= V3.1.5, >= 2.6.34 < 5.10.253, >= 5.11 < 5.15.203, >= 5.16 < 6.1.167, >= 6.2 < 6.6.130, >= 6.7 < 6.12.78, >= 6.13 < 6.18.20, >= 6.19 < 6.19.10, 7.0

Fixed versions

5.10.253, 5.15.203, 6.1.167, 6.6.130, 6.12.78, 6.18.20, 6.19.10

Technical data

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

CWE

Not available