{"api_version":"1","generated_at":"2026-10-02T21:36:53+00:00","cve":"CVE-2026-98077","urls":{"html":"https://cve.report/CVE-2026-98077","api":"https://cve.report/api/cve/CVE-2026-98077.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-98077","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-98077"},"summary":{"title":"netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace()\n\nsip_skip_whitespace() returns dptr unchanged when its own loop\nexhausts the buffer (dptr == limit), instead of NULL like its sibling\nsip_follow_continuation() returns on its own \"no more data\" path.\n\nct_sip_get_header() only checks for NULL after calling it:\n\n  dptr = sip_skip_whitespace(dptr, limit);\n  if (dptr == NULL)\n          break;\n  if (*dptr != ':' || ++dptr >= limit)\n          break;\n\nso a recognized header name followed only by spaces/tabs running to\nthe exact end of the SIP payload, with no colon, makes the very next\nstatement read one byte past the buffer.\n\nMake both \"no more data\" outcomes return NULL, matching the\nconvention sip_follow_continuation() already uses and that both\nexisting callers already check for.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-09-25 11:17:37","updated_at":"2026-09-30 14:10:59"},"problem_types":[],"metrics":[],"references":[{"url":"https://git.kernel.org/stable/c/4be8380e3af008f418f97992c06f23be649a430d","name":"https://git.kernel.org/stable/c/4be8380e3af008f418f97992c06f23be649a430d","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/4a30aa2ba007db18210dd52219ecbd5528c03523","name":"https://git.kernel.org/stable/c/4a30aa2ba007db18210dd52219ecbd5528c03523","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/60c012b2d05e1558b0f30ea3f15a2c3ca2f24d94","name":"https://git.kernel.org/stable/c/60c012b2d05e1558b0f30ea3f15a2c3ca2f24d94","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/e8f8231824b5815f57ce62cba116e511b10196de","name":"https://git.kernel.org/stable/c/e8f8231824b5815f57ce62cba116e511b10196de","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-98077","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98077","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected ea45f12a2766dae54e5426a23e8f4bafdbe2782e 60c012b2d05e1558b0f30ea3f15a2c3ca2f24d94 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected ea45f12a2766dae54e5426a23e8f4bafdbe2782e 4be8380e3af008f418f97992c06f23be649a430d git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected ea45f12a2766dae54e5426a23e8f4bafdbe2782e 4a30aa2ba007db18210dd52219ecbd5528c03523 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected ea45f12a2766dae54e5426a23e8f4bafdbe2782e e8f8231824b5815f57ce62cba116e511b10196de git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 2.6.26","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 2.6.26 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.111 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.53 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2.7 7.2.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.3-rc3 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"98077","cve":"CVE-2026-98077","epss":"0.002000000","percentile":"0.088280000","score_date":"2026-09-27","updated_at":"2026-09-28 00:02:24"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/netfilter/nf_conntrack_sip.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"60c012b2d05e1558b0f30ea3f15a2c3ca2f24d94","status":"affected","version":"ea45f12a2766dae54e5426a23e8f4bafdbe2782e","versionType":"git"},{"lessThan":"4be8380e3af008f418f97992c06f23be649a430d","status":"affected","version":"ea45f12a2766dae54e5426a23e8f4bafdbe2782e","versionType":"git"},{"lessThan":"4a30aa2ba007db18210dd52219ecbd5528c03523","status":"affected","version":"ea45f12a2766dae54e5426a23e8f4bafdbe2782e","versionType":"git"},{"lessThan":"e8f8231824b5815f57ce62cba116e511b10196de","status":"affected","version":"ea45f12a2766dae54e5426a23e8f4bafdbe2782e","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/netfilter/nf_conntrack_sip.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.26"},{"lessThan":"2.6.26","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.111","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.53","versionType":"semver"},{"lessThanOrEqual":"7.2.*","status":"unaffected","version":"7.2.7","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.3-rc3","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.111","versionStartIncluding":"2.6.26","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.53","versionStartIncluding":"2.6.26","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2.7","versionStartIncluding":"2.6.26","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.3-rc3","versionStartIncluding":"2.6.26","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace()\n\nsip_skip_whitespace() returns dptr unchanged when its own loop\nexhausts the buffer (dptr == limit), instead of NULL like its sibling\nsip_follow_continuation() returns on its own \"no more data\" path.\n\nct_sip_get_header() only checks for NULL after calling it:\n\n  dptr = sip_skip_whitespace(dptr, limit);\n  if (dptr == NULL)\n          break;\n  if (*dptr != ':' || ++dptr >= limit)\n          break;\n\nso a recognized header name followed only by spaces/tabs running to\nthe exact end of the SIP payload, with no colon, makes the very next\nstatement read one byte past the buffer.\n\nMake both \"no more data\" outcomes return NULL, matching the\nconvention sip_follow_continuation() already uses and that both\nexisting callers already check for."}],"providerMetadata":{"dateUpdated":"2026-09-25T10:24:15.691Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/60c012b2d05e1558b0f30ea3f15a2c3ca2f24d94"},{"url":"https://git.kernel.org/stable/c/4be8380e3af008f418f97992c06f23be649a430d"},{"url":"https://git.kernel.org/stable/c/4a30aa2ba007db18210dd52219ecbd5528c03523"},{"url":"https://git.kernel.org/stable/c/e8f8231824b5815f57ce62cba116e511b10196de"}],"title":"netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace()","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-98077","datePublished":"2026-09-25T10:24:15.691Z","dateReserved":"2026-09-25T10:19:56.074Z","dateUpdated":"2026-09-25T10:24:15.691Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-09-25 11:17:37","lastModifiedDate":"2026-09-30 14:10:59","problem_types":[],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"98077","Ordinal":"1","Title":"netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace","CVE":"CVE-2026-98077","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"98077","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace()\n\nsip_skip_whitespace() returns dptr unchanged when its own loop\nexhausts the buffer (dptr == limit), instead of NULL like its sibling\nsip_follow_continuation() returns on its own \"no more data\" path.\n\nct_sip_get_header() only checks for NULL after calling it:\n\n  dptr = sip_skip_whitespace(dptr, limit);\n  if (dptr == NULL)\n          break;\n  if (*dptr != ':' || ++dptr >= limit)\n          break;\n\nso a recognized header name followed only by spaces/tabs running to\nthe exact end of the SIP payload, with no colon, makes the very next\nstatement read one byte past the buffer.\n\nMake both \"no more data\" outcomes return NULL, matching the\nconvention sip_follow_continuation() already uses and that both\nexisting callers already check for.","Type":"Description","Title":"netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace"}]}}}