CVE-2026-74569 (GCVE-0-2026-74569)

Vulnerability from cvelistv5 – Published: 2026-08-15 12:28 – Updated: 2026-08-19 16:39
VLAI
Title
netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp()
Summary
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() sip_help_tcp() stores the size change of each NAT-rewritten SIP message in s16 diff and accumulates it in s16 tdiff, but a single message can grow by more than S16_MAX while the packet stays under the 65535 enlarge_skb() limit: nf_nat_sip() rewrites every matching URI, and a long Contact list expands the message by tens of kilobytes. diff then wraps, and "datalen = datalen + diff - msglen" yields a huge unsigned datalen, so the next iteration's ct_sip_get_header() reads past the linearized skb tail. Widen diff, tdiff and the seq_adjust hook to s32. Both are bounded by the 65535 byte packet limit, and the seqadj core is already s32 (nf_ct_seqadj_set() takes s32), so no previously accepted input is rejected. BUG: KASAN: use-after-free in ct_sip_get_header (net/netfilter/nf_conntrack_sip.c:464) Read of size 1 at addr ffff888010800000 by task ksoftirqd/1/25 ct_sip_get_header (net/netfilter/nf_conntrack_sip.c:464) sip_help_tcp (net/netfilter/nf_conntrack_sip.c:1694) nf_confirm (net/netfilter/nf_conntrack_proto.c:183) nf_hook_slow (net/netfilter/core.c:619) ip6_output (net/ipv6/ip6_output.c:246) ip6_forward (net/ipv6/ip6_output.c:690) ipv6_rcv (net/ipv6/ip6_input.c:351) __netif_receive_skb_one_core (net/core/dev.c:6212) process_backlog (net/core/dev.c:6676) __napi_poll (net/core/dev.c:7735) net_rx_action (net/core/dev.c:7955) handle_softirqs (kernel/softirq.c:622) run_ksoftirqd (kernel/softirq.c:1076) ...
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: f5b321bd37fbec9188feb1f721ab46a5ac0b35da , < ed1f9be6dc8e2e280b8725e44ccdc6e0cd38640d (git)
Affected: f5b321bd37fbec9188feb1f721ab46a5ac0b35da , < 1b0843f9e9b9b0b9b4b70d143b67e58163c85b2c (git)
Affected: f5b321bd37fbec9188feb1f721ab46a5ac0b35da , < 32d4abc8923b0d4046fd63ad6e4917872e44eb6d (git)
Affected: f5b321bd37fbec9188feb1f721ab46a5ac0b35da , < 63eea41759fd682229c14e0a2205802b46d106f3 (git)
Affected: f5b321bd37fbec9188feb1f721ab46a5ac0b35da , < c97621a110e386b2dd69e276eb699e1d3cec581d (git)
Affected: f5b321bd37fbec9188feb1f721ab46a5ac0b35da , < f74554e67ccf04d1fa71069e8c9afa2717e40716 (git)
Affected: f5b321bd37fbec9188feb1f721ab46a5ac0b35da , < ef5e2c6555d2bb52dfe0e4053a8c6193f9d83b64 (git)
Affected: f5b321bd37fbec9188feb1f721ab46a5ac0b35da , < db3d0e0e5d4bc5ab4fe445b9f413d1b486508ca5 (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.34
Unaffected: 0 , < 2.6.34 (semver)
Unaffected: 5.10.265 , ≤ 5.10.* (semver)
Unaffected: 5.15.216 , ≤ 5.15.* (semver)
Unaffected: 6.1.183 , ≤ 6.1.* (semver)
Unaffected: 6.6.151 , ≤ 6.6.* (semver)
Unaffected: 6.12.103 , ≤ 6.12.* (semver)
Unaffected: 6.18.44 , ≤ 6.18.* (semver)
Unaffected: 7.1.8 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/linux/netfilter/nf_conntrack_sip.h",
            "net/netfilter/nf_conntrack_sip.c",
            "net/netfilter/nf_nat_sip.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ed1f9be6dc8e2e280b8725e44ccdc6e0cd38640d",
              "status": "affected",
              "version": "f5b321bd37fbec9188feb1f721ab46a5ac0b35da",
              "versionType": "git"
            },
            {
              "lessThan": "1b0843f9e9b9b0b9b4b70d143b67e58163c85b2c",
              "status": "affected",
              "version": "f5b321bd37fbec9188feb1f721ab46a5ac0b35da",
              "versionType": "git"
            },
            {
              "lessThan": "32d4abc8923b0d4046fd63ad6e4917872e44eb6d",
              "status": "affected",
              "version": "f5b321bd37fbec9188feb1f721ab46a5ac0b35da",
              "versionType": "git"
            },
            {
              "lessThan": "63eea41759fd682229c14e0a2205802b46d106f3",
              "status": "affected",
              "version": "f5b321bd37fbec9188feb1f721ab46a5ac0b35da",
              "versionType": "git"
            },
            {
              "lessThan": "c97621a110e386b2dd69e276eb699e1d3cec581d",
              "status": "affected",
              "version": "f5b321bd37fbec9188feb1f721ab46a5ac0b35da",
              "versionType": "git"
            },
            {
              "lessThan": "f74554e67ccf04d1fa71069e8c9afa2717e40716",
              "status": "affected",
              "version": "f5b321bd37fbec9188feb1f721ab46a5ac0b35da",
              "versionType": "git"
            },
            {
              "lessThan": "ef5e2c6555d2bb52dfe0e4053a8c6193f9d83b64",
              "status": "affected",
              "version": "f5b321bd37fbec9188feb1f721ab46a5ac0b35da",
              "versionType": "git"
            },
            {
              "lessThan": "db3d0e0e5d4bc5ab4fe445b9f413d1b486508ca5",
              "status": "affected",
              "version": "f5b321bd37fbec9188feb1f721ab46a5ac0b35da",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/linux/netfilter/nf_conntrack_sip.h",
            "net/netfilter/nf_conntrack_sip.c",
            "net/netfilter/nf_nat_sip.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.34"
            },
            {
              "lessThan": "2.6.34",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.151",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.151",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.103",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp()\n\nsip_help_tcp() stores the size change of each NAT-rewritten SIP message\nin s16 diff and accumulates it in s16 tdiff, but a single message can\ngrow by more than S16_MAX while the packet stays under the 65535\nenlarge_skb() limit: nf_nat_sip() rewrites every matching URI, and a long\nContact list expands the message by tens of kilobytes. diff then wraps,\nand \"datalen = datalen + diff - msglen\" yields a huge unsigned datalen,\nso the next iteration\u0027s ct_sip_get_header() reads past the linearized skb\ntail.\n\nWiden diff, tdiff and the seq_adjust hook to s32. Both are bounded by the\n65535 byte packet limit, and the seqadj core is already s32\n(nf_ct_seqadj_set() takes s32), so no previously accepted input is\nrejected.\n\n  BUG: KASAN: use-after-free in ct_sip_get_header (net/netfilter/nf_conntrack_sip.c:464)\n  Read of size 1 at addr ffff888010800000 by task ksoftirqd/1/25\n   ct_sip_get_header (net/netfilter/nf_conntrack_sip.c:464)\n   sip_help_tcp (net/netfilter/nf_conntrack_sip.c:1694)\n   nf_confirm (net/netfilter/nf_conntrack_proto.c:183)\n   nf_hook_slow (net/netfilter/core.c:619)\n   ip6_output (net/ipv6/ip6_output.c:246)\n   ip6_forward (net/ipv6/ip6_output.c:690)\n   ipv6_rcv (net/ipv6/ip6_input.c:351)\n   __netif_receive_skb_one_core (net/core/dev.c:6212)\n   process_backlog (net/core/dev.c:6676)\n   __napi_poll (net/core/dev.c:7735)\n   net_rx_action (net/core/dev.c:7955)\n   handle_softirqs (kernel/softirq.c:622)\n   run_ksoftirqd (kernel/softirq.c:1076)\n   ..."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - Remote attackers trigger sip_help_tcp() by sending crafted TCP SIP traffic that traverses netfilter nf_confirm() on POST_ROUTING/LOCAL_IN during packet receive/forward (ipv6_rcv\u2192ip6_forward\u2192ip6_output\u2192nf_hook_slow), the standard path for network-facing SIP ALG/NAT gateways.\nAC:L - Once nf_conntrack_sip and nf_nat_sip are active on a NATed SIP flow, the attacker fully controls the TCP SIP payload (Contact list length and private URIs) to force \u003e32KB NAT expansion and deterministic s16 wrap; no race or external timing is required.\nPR:N - Exploitation requires no privileges on the victim kernel; a remote SIP peer only needs to deliver malicious TCP SIP packets through an already-configured SIP conntrack/NAT helper, with no authentication or local access to the target system.\nUI:N - No victim user interaction is required beyond normal automated packet processing; the helper parses and NAT-rewrites attacker-supplied SIP data in softirq during connection tracking confirmation without any user action.\nS:U - Impact is confined to kernel netfilter/conntrack memory on the same security authority (e.g., a NAT firewall or router). This is not a VM escape, sandbox breakout, or cross-tenant boundary violation.\nC:H - Integer overflow yields a huge unsigned datalen, causing ct_sip_get_header() to read past the linearized skb tail; KASAN reports a use-after-free read, and this out-of-bounds/UAF access can disclose adjacent kernel heap memory beyond the packet buffer.\nI:H - Although the immediate fault is a read past skb bounds, KASAN-classified UAF/out-of-bounds kernel heap corruption is exploitable with heap grooming for control of freed/reallocated objects, enabling arbitrary write and potential code execution in kernel context.\nA:H - The corrupted datalen drives out-of-bounds access in softirq packet processing (ksoftirqd), which can cause kernel oops/panic and denial of service on the NAT/firewall handling the SIP flow; the bug is reliably triggerable with crafted packets."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:39:11.673Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ed1f9be6dc8e2e280b8725e44ccdc6e0cd38640d"
        },
        {
          "url": "https://git.kernel.org/stable/c/1b0843f9e9b9b0b9b4b70d143b67e58163c85b2c"
        },
        {
          "url": "https://git.kernel.org/stable/c/32d4abc8923b0d4046fd63ad6e4917872e44eb6d"
        },
        {
          "url": "https://git.kernel.org/stable/c/63eea41759fd682229c14e0a2205802b46d106f3"
        },
        {
          "url": "https://git.kernel.org/stable/c/c97621a110e386b2dd69e276eb699e1d3cec581d"
        },
        {
          "url": "https://git.kernel.org/stable/c/f74554e67ccf04d1fa71069e8c9afa2717e40716"
        },
        {
          "url": "https://git.kernel.org/stable/c/ef5e2c6555d2bb52dfe0e4053a8c6193f9d83b64"
        },
        {
          "url": "https://git.kernel.org/stable/c/db3d0e0e5d4bc5ab4fe445b9f413d1b486508ca5"
        }
      ],
      "title": "netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74569",
    "datePublished": "2026-08-15T12:28:09.476Z",
    "dateReserved": "2026-08-15T05:44:03.917Z",
    "dateUpdated": "2026-08-19T16:39:11.673Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74569",
      "date": "2026-10-02",
      "epss": "0.00388",
      "percentile": "0.30489"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-25T02:23:26.000Z",
      "cve": "CVE-2026-74569",
      "id": "msrc_CVE-2026-74569",
      "initial_release_date": "2026-08-23T14:58:35.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp()",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-74569.json",
      "version": "3"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "include/linux/netfilter/nf_conntrack_sip.h",
                  "net/netfilter/nf_conntrack_sip.c",
                  "net/netfilter/nf_nat_sip.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "ed1f9be6dc8e2e280b8725e44ccdc6e0cd38640d",
                    "status": "affected",
                    "version": "f5b321bd37fbec9188feb1f721ab46a5ac0b35da",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "1b0843f9e9b9b0b9b4b70d143b67e58163c85b2c",
                    "status": "affected",
                    "version": "f5b321bd37fbec9188feb1f721ab46a5ac0b35da",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "32d4abc8923b0d4046fd63ad6e4917872e44eb6d",
                    "status": "affected",
                    "version": "f5b321bd37fbec9188feb1f721ab46a5ac0b35da",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "63eea41759fd682229c14e0a2205802b46d106f3",
                    "status": "affected",
                    "version": "f5b321bd37fbec9188feb1f721ab46a5ac0b35da",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c97621a110e386b2dd69e276eb699e1d3cec581d",
                    "status": "affected",
                    "version": "f5b321bd37fbec9188feb1f721ab46a5ac0b35da",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f74554e67ccf04d1fa71069e8c9afa2717e40716",
                    "status": "affected",
                    "version": "f5b321bd37fbec9188feb1f721ab46a5ac0b35da",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ef5e2c6555d2bb52dfe0e4053a8c6193f9d83b64",
                    "status": "affected",
                    "version": "f5b321bd37fbec9188feb1f721ab46a5ac0b35da",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "db3d0e0e5d4bc5ab4fe445b9f413d1b486508ca5",
                    "status": "affected",
                    "version": "f5b321bd37fbec9188feb1f721ab46a5ac0b35da",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "include/linux/netfilter/nf_conntrack_sip.h",
                  "net/netfilter/nf_conntrack_sip.c",
                  "net/netfilter/nf_nat_sip.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "2.6.34"
                  },
                  {
                    "lessThan": "2.6.34",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.265",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.216",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.183",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.151",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.103",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.44",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.8",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp()\n\nsip_help_tcp() stores the size change of each NAT-rewritten SIP message\nin s16 diff and accumulates it in s16 tdiff, but a single message can\ngrow by more than S16_MAX while the packet stays under the 65535\nenlarge_skb() limit: nf_nat_sip() rewrites every matching URI, and a long\nContact list expands the message by tens of kilobytes. diff then wraps,\nand \"datalen = datalen + diff - msglen\" yields a huge unsigned datalen,\nso the next iteration\u0027s ct_sip_get_header() reads past the linearized skb\ntail.\n\nWiden diff, tdiff and the seq_adjust hook to s32. Both are bounded by the\n65535 byte packet limit, and the seqadj core is already s32\n(nf_ct_seqadj_set() takes s32), so no previously accepted input is\nrejected.\n\n  BUG: KASAN: use-after-free in ct_sip_get_header (net/netfilter/nf_conntrack_sip.c:464)\n  Read of size 1 at addr ffff888010800000 by task ksoftirqd/1/25\n   ct_sip_get_header (net/netfilter/nf_conntrack_sip.c:464)\n   sip_help_tcp (net/netfilter/nf_conntrack_sip.c:1694)\n   nf_confirm (net/netfilter/nf_conntrack_proto.c:183)\n   nf_hook_slow (net/netfilter/core.c:619)\n   ip6_output (net/ipv6/ip6_output.c:246)\n   ip6_forward (net/ipv6/ip6_output.c:690)\n   ipv6_rcv (net/ipv6/ip6_input.c:351)\n   __netif_receive_skb_one_core (net/core/dev.c:6212)\n   process_backlog (net/core/dev.c:6676)\n   __napi_poll (net/core/dev.c:7735)\n   net_rx_action (net/core/dev.c:7955)\n   handle_softirqs (kernel/softirq.c:622)\n   run_ksoftirqd (kernel/softirq.c:1076)\n   ..."
          }
        ],
        "id": "CVE-2026-74569",
        "lastModified": "2026-08-19T17:21:11.713",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-15T13:18:02.517",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/1b0843f9e9b9b0b9b4b70d143b67e58163c85b2c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/32d4abc8923b0d4046fd63ad6e4917872e44eb6d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/63eea41759fd682229c14e0a2205802b46d106f3"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/c97621a110e386b2dd69e276eb699e1d3cec581d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/db3d0e0e5d4bc5ab4fe445b9f413d1b486508ca5"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/ed1f9be6dc8e2e280b8725e44ccdc6e0cd38640d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/ef5e2c6555d2bb52dfe0e4053a8c6193f9d83b64"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f74554e67ccf04d1fa71069e8c9afa2717e40716"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-09-24T09:30:18+00:00",
      "cve": "CVE-2026-74569",
      "id": "CVE-2026-74569",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:fixed": "309",
      "product_status:known_affected": "184",
      "product_status:under_investigation": "14",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74569.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T01:18:44Z",
      "cve": "CVE-2026-74569",
      "id": "CVE-2026-74569",
      "initial_release_date": "2026-08-18T16:53:34Z",
      "product_status:known_affected": "362",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-74569",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-74569.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.