CVE-2026-72253

netfilter: nf_conntrack_sip: validate skb_dst() before accessing it

State: Published
Severity: 7.5 High
Published: Aug 15, 2026
Updated: Oct 16, 2026
Reserved: Aug 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_conntrack_sip: validate skb_dst() before accessing it

tc ingress and openvswitch do not guarantee routing information to be available. These subsystems use the conntrack helper infrastructure, and the SIP helper relies on the skb_dst() to be present if sip_external_media is set to 1 (which is disabled by default as a module parameter).

This effectively disables the sip_external_media toggle for these subsystems without resulting in a crash.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	cae3a2627520c3795b54533c5328b77af3405dbe to before 7866116a040b3a23fb094e7d8f7ea3d61b3ac70bAffected cae3a2627520c3795b54533c5328b77af3405dbe to before c5ef7228be04518d95591fc5369a9c554b19756dAffected cae3a2627520c3795b54533c5328b77af3405dbe to before 0aec339694a56e263d4b22475ff7211d40900830Affected cae3a2627520c3795b54533c5328b77af3405dbe to before e64a48c50a1ff565a98c6a98d82b5b942868e76eAffected cae3a2627520c3795b54533c5328b77af3405dbe to before c199ed687c00841daf60e9d131976958583a8c09Affected cae3a2627520c3795b54533c5328b77af3405dbe to before 09755dc62b026076b1d47f83489eb0547c8135e0Affected cae3a2627520c3795b54533c5328b77af3405dbe to before b843a96252f672332837ea2ecb7c8db0acf68e20Affected cae3a2627520c3795b54533c5328b77af3405dbe to before e5e24a365a5e024efef63cc49abb345fbd4852c5Affected
LinuxLinux	4.3Affected before 4.3Not affected 5.10.266 through 5.10.Not affected 5.15.217 through 5.15.Not affected 6.1.184 through 6.1.Not affected 6.6.148 through 6.6.Not affected 6.12.101 through 6.12.Not affected 6.18.42 through 6.18.Not affected 7.1.5 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

cae3a2627520c3795b54533c5328b77af3405dbe to before 7866116a040b3a23fb094e7d8f7ea3d61b3ac70bAffected
cae3a2627520c3795b54533c5328b77af3405dbe to before c5ef7228be04518d95591fc5369a9c554b19756dAffected
cae3a2627520c3795b54533c5328b77af3405dbe to before 0aec339694a56e263d4b22475ff7211d40900830Affected
cae3a2627520c3795b54533c5328b77af3405dbe to before e64a48c50a1ff565a98c6a98d82b5b942868e76eAffected
cae3a2627520c3795b54533c5328b77af3405dbe to before c199ed687c00841daf60e9d131976958583a8c09Affected
cae3a2627520c3795b54533c5328b77af3405dbe to before 09755dc62b026076b1d47f83489eb0547c8135e0Affected
cae3a2627520c3795b54533c5328b77af3405dbe to before b843a96252f672332837ea2ecb7c8db0acf68e20Affected
cae3a2627520c3795b54533c5328b77af3405dbe to before e5e24a365a5e024efef63cc49abb345fbd4852c5Affected

LinuxLinux

4.3Affected
before 4.3Not affected
5.10.266 through 5.10.*Not affected
5.15.217 through 5.15.*Not affected
6.1.184 through 6.1.*Not affected
6.6.148 through 6.6.*Not affected
6.12.101 through 6.12.*Not affected
6.18.42 through 6.18.*Not affected
7.1.5 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.