CVE-2026-100070
Description
A flaw was found in the Linux kernel. This vulnerability can result in information disclosure when processing Session Initiation Protocol (SIP) traffic through the netfilter Network Address Translation (NAT) helper. When address rewriting shortens a packet, the helper fails to adjust its internal offset, causing subsequent Contact headers to be skipped during translation. Consequently, an external recipient or network observer may receive untranslated internal IP addresses, exposing private network details.
Statement
Red Hat rates this flaw as moderate. It is an information disclosure issue in the Linux kernel's netfilter SIP NAT helper (nf_nat_sip), affecting the kernel packages in Red Hat Enterprise Linux, Red Hat In-Vehicle OS, and the Red Hat Enterprise Linux CoreOS layers of Red Hat OpenShift Container Platform. When the helper rewrites addresses in Session Initiation Protocol (SIP) packets and the public NAT address string is shorter than the internal address it replaces, the packet shrinks but the helper's internal parsing offset is not adjusted. The stale offset can cause a subsequent Contact header to be skipped during translation, so the packet is sent with an untranslated internal IP address. A remote attacker or network observer who can cause a NATed SIP message containing multiple Contact headers to be processed could use this to learn internal network addresses or topology. The flaw does not involve memory corruption, privilege escalation, or denial of service. Exploitation requires the non-default SIP connection tracking/NAT helper to be enabled and active, a NAT configuration in which address rewriting shortens the packet, and SIP messages containing multiple Contact headers. Red Hat Enterprise Linux 6 is not affected because the vulnerable code is not present in that release. Fixes for the affected products are currently deferred to a future update; the residual risk is limited to disclosure of internal network addressing on systems that pass SIP traffic through the netfilter SIP NAT helper.
Mitigation
The vulnerable code path is only reachable when the SIP connection tracking/NAT helper is enabled, which is not the default configuration. On systems where the SIP NAT helper has been explicitly enabled, disabling it (for example, by unloading or preventing the loading of the nf_conntrack_sip and nf_nat_sip kernel modules, or by disabling automatic conntrack helper assignment for SIP traffic) prevents netfilter from rewriting SIP payloads and thereby prevents untranslated Contact headers from being sent to external recipients. Note that disabling the helper also disables SIP application-level gateway (ALG) processing, which may affect SIP deployments that rely on it, so the operational impact should be evaluated before applying this change.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | 5.5 | N/A |
| Attack Vector | Local | Local | N/A |
| Attack Complexity | Low | Low | N/A |
| Privileges Required | Low | Low | N/A |
| User Interaction | None | None | N/A |
| Scope | Unchanged | Unchanged | N/A |
| Confidentiality | None | None | N/A |
| Integrity Impact | None | None | N/A |
| Availability Impact | High | High | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
NVD: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Files or Directories; Read Application Data
Sensitive data may be exposed to an unauthorized actor in another control sphere. This may have a wide range of secondary consequences that will depend on what data is exposed. One possibility is the exposure of system data - such as file locations, software versions, or device data - that allow an attacker to craft a specific, more effective attack. Alternately, insufficient redaction of Private Personal Information (PPI), Personally Identifiable Information (PII), or other types of information might not harm the secure operation of the product itself, but could be violations of expectations by the product's users.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
