[SRU][Q][PATCH 0/1] CVE-2026-52986

[Cengiz Can]

https://ubuntu.com/security/CVE-2026-52986

[ Impact ]

The nf_conntrack_sip connection tracking helper parsed SIP port numbers using
simple_strtoul(), which assumes NUL-terminated strings, and dereferenced
pointers without bounds checks after sip_parse_addr(). When operating on non-
NUL-terminated skb data in epaddr_len(), ct_sip_parse_header_uri(), and
ct_sip_parse_request(), this could lead to reads past the buffer limit on
malformed SIP packets. An attacker able to send crafted SIP traffic could
exploit this to trigger out-of-bounds access in the kernel.

[ Fix ]

questing: clean cherry-pick
focal: clean cherry-pick
bionic: clean cherry-pick
xenial: backported with AI-assisted adaptation
trusty: backported with AI-assisted adaptation

[ Test Plan ]

Boot tested.

[ Where Problems Could Occur ]

The fix makes SIP port parsing stricter in the netfilter nf_conntrack_sip
helper, so malformed or unusually formatted (but previously accepted) SIP
messages may no longer be tracked, potentially affecting NAT traversal for some
SIP setups. Any regression would be confined to connection tracking of SIP
traffic.