CVE-2026-98077

Executive Summary

CVE-2026-98077 is an out-of-bounds (OOB) read in the Linux kernel Netfilter connection-tracking helper nf_conntrack_sip, specifically in the sip_skip_whitespace() function invoked during SIP header parsing by ct_sip_get_header(). The flaw is reachable by remote, unauthenticated network traffic: any host or firewall running the nf_conntrack_sip helper on a path that inspects SIP (port 5060/5061) can be driven into a one-byte over-read when a recognized header name is followed only by spaces/tabs to the exact end of the SIP payload with no terminating colon. Impact is denial of service (kernel crash/panic) and potential limited information disclosure from adjacent kernel memory. No public PoC, exploit code, Nuclei template, or CISA KEV entry exists as of this writing, and no vendor fix has been confirmed.

Technical Analysis

The Linux Netfilter subsystem provides stateful connection tracking. For SIP (Session Initiation Protocol) traffic, the nf_conntrack_sip helper parses SIP messages to extract header fields so the conntrack engine can correctly track related media flows. Header parsing is performed by ct_sip_get_header(), which walks the SIP payload and delegates whitespace handling to sip_skip_whitespace().

The vulnerability lies in an inconsistency between two helper functions in the same parsing module:

• sip_follow_continuation() returns NULL when it reaches its "no more data" condition (i.e., the buffer limit limit is reached).
• sip_skip_whitespace() instead returns dptr unchanged when its own loop exhausts the buffer (dptr == limit), rather than returning NULL.

ct_sip_get_header() only checks the return value for NULL:

dptr = sip_skip_whitespace(dptr, limit);
if (dptr == NULL)
        break;
if (*dptr != ':' || ++dptr >= limit)
        break;

Because sip_skip_whitespace() can legally return dptr == limit (a non-NULL pointer pointing exactly one past the last valid byte), the NULL check does not catch this case. Control then reaches the dereference *dptr, which reads one byte past the bounds of the SIP payload buffer — an out-of-bounds read.

Trigger condition (per the NVD description): a recognized SIP header name that is followed only by spaces and/or tab characters running to the exact end of the SIP payload, with no trailing colon. In that exact geometry, sip_skip_whitespace() consumes the trailing whitespace and lands on limit, returns the limit pointer, the NULL guard passes, and the subsequent *dptr dereference over-reads by one byte.

Root cause class: CWE-125 (Out-of-bounds Read), driven by inconsistent error-signaling conventions between sibling parsing helpers (a "no more data" outcome expressed as a valid pointer instead of NULL). The described fix is to make both "no more data" outcomes return NULL, matching the convention already used by sip_follow_continuation() and already checked by both existing callers.

Attack surface: The parser operates on network-supplied SIP payloads. The over-read is therefore driven by attacker-controlled packet content and is reachable pre-authentication wherever the SIP conntrack helper is active for inspected traffic.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class and the specific parsing logic described in the NVD entry. All named functions are taken verbatim from the description.

1. Reconnaissance / target identification. The attacker identifies a target host or network boundary device (Linux host, firewall, router, VPS) with connection tracking enabled and the nf_conntrack_sip helper loaded/active for SIP traffic — typically those inspecting UDP/TCP 5060 or 5061. Shodan-style discovery of exposed SIP services (port 5060) helps prioritize targets, but the relevant condition is whether the kernel parses SIP via the conntrack SIP helper, not merely whether SIP is exposed.

2. Triggering the flaw class (OOB read via parser malformed-input handling). The attacker crafts a SIP message whose payload ends precisely with a recognized header name followed only by space and/or tab characters and no colon, with the whitespace running to the exact end of the payload. The exact header keywords recognized by the parser determine which name is used, but per the description the trigger is the "recognized header name + trailing whitespace to end-of-buffer, no colon" geometry.

3. Delivery / execution method (vulnerability-class level). The crafted SIP payload is sent to the target as a normal network packet (SIP over UDP/TCP 5060/5061, or within a TLS-wrapped flow where decrypted and inspected). The conntrack SIP helper processes the payload during connection tracking, reaches sip_skip_whitespace(), exhausts the buffer, and returns the limit pointer — causing the following *dptr read in ct_sip_get_header() to access memory one byte past the payload buffer.

4. Post-exploitation impact. The out-of-bounds read can return one byte of adjacent kernel memory (limited information disclosure) and, more reliably, can fault (page boundary / KASAN-detected access / bad memory access) and crash the kernel — a remote denial-of-service condition on the affected host or the filtering device. If the read value is used to make a parse decision, it may additionally desynchronize conntrack parsing for the flow, though the primary demonstrable effects are DoS and limited infoleak. No privilege escalation, code execution, or authentication bypass is indicated by the description.

Impact Assessment

• Confidentiality (C:L): Low. The primitive is a single-byte over-read from kernel memory past the SIP payload; disclosure is limited and not reliably controllable by the attacker.
• Integrity (I:N): None indicated. The flaw is a read, not a write.
• Availability (A:H): High. An out-of-bounds read in kernel context can trigger a fault, panic, or KASAN-reported kernel crash, yielding remote denial of service against the affected host or the network device inspecting SIP traffic.
• Attack Vector (AV:N), Complexity (AC:L), Privileges (PR:N), User Interaction (UI:N): Network-reachable, low complexity, unauthenticated, no user interaction — making it attractive for nuisance/DoS campaigns and for disrupting SIP/VoIP infrastructure and perimeter appliances.
• Affected systems / blast radius: Linux kernels with the SIP conntrack helper active — including SIP/VoIP servers, PBXs, softswitches, and Linux-based firewalls/routers/NAT gateways that inspect SIP (commonly via NAT/ALG helpers on 5060/5061). The blast radius scales with how many flows traverse a single conntrack-processing node (a perimeter firewall crash affects all downstream traffic).
• Business impact: VoIP/UC service outages, dropped calls, firewall/router instability, and potential exposure of one byte of kernel memory per crafted packet. Because SOHO/enterprise edge devices often share a single kernel conntrack path, a crash is node-wide, not per-call.

CVSS is provided as N/A in the source data; the vector above is analyst-derived for triage only and must not be treated as an authoritative rating.

Detection Guidance

Sigma Rule

title: Potential Linux nf_conntrack_sip OOB Read Parsing Attempt (CVE-2026-98077)
id: 9f2c7b41-3a6e-4d9f-b0c1-8e5d7a2f6c10
status: experimental
description: Detects SIP payloads that terminate with a header name followed only by spaces/tabs and no colon, consistent with the trigger geometry for the nf_conntrack_sip sip_skip_whitespace OOB read.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-98077
author: Threat Intelligence
date: 2026-01-01
logsource:
  category: network_connection
  product: linux
detection:
  selection_ports:
    dst_port:
      - 5060
      - 5061
  selection_payload:
    payload|re: '[A-Za-z-]+[ \t]+$'
  condition: selection_ports and selection_payload
fields:
  - src_ip
  - dst_ip
  - dst_port
  - payload
falsepositives:
  - Malformed or truncated SIP clients
  - Fuzzing/security testing of SIP services
level: medium
tags:
  - attack.t1212
  - cve.2026.98077

YARA Rule

rule CVE_2026_98077_nf_conntrack_sip_oob_read_trigger
{
    meta:
        description = "Detects SIP payloads matching the CVE-2026-98077 trigger geometry: recognized header name followed only by spaces/tabs to end of buffer, no colon."
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-98077"
        cve = "CVE-2026-98077"
        author = "Threat Intelligence"
        date = "2026-01-01"

    strings:
        $hdr = /[A-Za-z][A-Za-z0-9-]*[ \t]+\r?\n?$/

    condition:
        $hdr
}

Suricata IDS Rule

alert udp any any -> any 5060 (msg:"CVE-2026-98077 Linux nf_conntrack_sip sip_skip_whitespace OOB read attempt (header name + trailing whitespace, no colon)"; flow:to_server; content:"SIP/"; nocase; pcre:"/[A-Za-z][A-Za-z0-9-]*[ \t]+\r?$/R"; classtype:attempted-dos; reference:cve,2026-98077; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-98077; sid:202698077; rev:1;)
alert tcp any any -> any 5060 (msg:"CVE-2026-98077 Linux nf_conntrack_sip sip_skip_whitespace OOB read attempt (header name + trailing whitespace, no colon)"; flow:to_server,established; content:"SIP/"; nocase; pcre:"/[A-Za-z][A-Za-z0-9-]*[ \t]+\r?$/R"; classtype:attempted-dos; reference:cve,2026-98077; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-98077; sid:202698078; rev:1;)

Elastic Detection

sequence by process.name with maxspan=5s
  [ network where destination.port in (5060, 5061) and network.transport in ("udp","tcp") ]
  [ network where destination.port in (5060, 5061) and network.transport in ("udp","tcp") and wildcard(network.payload, "*  ") ]

Splunk SPL Query

index=network (dest_port=5060 OR dest_port=5061)
| eval raw = coalesce(payload, _raw)
| where match(raw, "(?i)REGISTER|INVITE|SIP/2\\.0")
| rex field=raw "(?<hdrline>[A-Za-z][A-Za-z0-9-]*[ \t]+)\r?$"
| where isnotnull(hdrline)
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, dest_ip, dest_port, hdrline
| where count > 3
| sort - count

Wazuh OSSEC Rule

<group name="linux,netfilter,sip,cve-2026-98077,">
  <rule id="100977" level="8">
    <decoded_as>json</decoded_as>
    <field name="dst_port">5060|5061</field>
    <field name="payload" type="pcre2">[A-Za-z][A-Za-z0-9-]*[ \t]+\r?$</field>
    <description>CVE-2026-98077: possible nf_conntrack_sip sip_skip_whitespace OOB read attempt (SIP header name followed only by whitespace, no colon)</description>
    <mitre>
      <id>T1212</id>
    </mitre>
    <group>attack,dos,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No affected-version list, vendor advisory, or fixed release has been confirmed. Treat all kernels exposing the SIP conntrack helper as potentially vulnerable until a vendor fix is verified.

1. Immediate mitigations.

   • Disable the SIP connection-tracking helper where it is not strictly required: nf_conntrack_sip (modprobe -r nf_conntrack_sip / blacklist where permitted). Note that many NAT/ALG deployments rely on it; validate the operational impact first.
   • Block or restrict inbound SIP (UDP/TCP 5060 and 5061) to trusted peers/subnets at the perimeter, reducing exposure of the parser to untrusted input.
   • Prefer placing SIP inspection behind a dedicated, isolated edge appliance rather than a shared kernel conntrack path, so a crash has a smaller blast radius.
   • Monitor for kernel faults/panics and KASAN out-of-bounds reports while processing SIP flows; treat repeated anomalies on SIP traffic as a signal to apply mitigations.

2. Patch / upgrade steps.

   • Apply the upstream Linux kernel fix only when it is confirmed available from your distribution's security channel (the described change makes both "no more data" outcomes of the SIP whitespace/continuation parsers return NULL). No fixed kernel version or commit hash has been confirmed in this dataset — do not assume any release is patched.
   • Track the Linux kernel netfilter/nf_conntrack_sip stable and mainline branches and your distro's advisory feed for the official reference.
   • Reboot into the patched kernel and verify the loaded module is the updated build.

3. Long-term hardening.

   • Minimize enabled conntrack helpers to the exact set required (least functionality); audit nf_conntrack_sip enablement per host and edge device.
   • Enable kernel hardening/reporting (KASAN in test/staging, and robust panic/telemetry forwarding) to catch parser defects early.
   • Segment VoIP/UC from general network paths so parsing bugs are not reachable from broad untrusted sources.
   • Maintain a monitored upgrade cadence for kernel and Netfilter packages at the edge, where remotely reachable parser bugs have the largest blast radius.

References

• NVD — CVE-2026-98077: https://nvd.nist.gov/vuln/detail/CVE-2026-98077
• Linux kernel netfilter subsystem (nf_conntrack_sip) upstream source and commit history: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
• CWE-125 — Out-of-bounds Read: https://cwe.mitre.org/data/definitions/125.html
• CISA Known Exploited Vulnerabilities Catalog (verify status; CVE-2026-98077 is not listed as of this writing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• FIRST EPSS (not yet scored for this CVE; do not assume a value): https://www.first.org/epss

No threat actor campaigns or exploit-in-the-wild evidence have been identified for CVE-2026-98077. No public PoC, exploit code, or Nuclei template is available; the exploit chain described above is inferred from the vulnerability class and the parsing logic stated in the NVD description.