[SRU][Q][PATCH 0/1] CVE-2026-53002

[Cengiz Can]

https://ubuntu.com/security/CVE-2026-53002

[ Impact ]

The SIP connection tracking helper in netfilter used sprintf() in
mangle_content_len() to write into a stack buffer that could be too small to
hold the formatted result. This caused a stack out-of-bounds write when
mangling SDP content length during NAT of SIP INVITE requests. An attacker able
to trigger this path could corrupt kernel stack memory, potentially leading to
denial of service or remote code execution, as reflected by the CVSS score of
9.8.

[ Fix ]

questing: clean cherry-pick
focal: clean cherry-pick
bionic: clean cherry-pick
xenial: backported with AI-assisted adaptation
trusty: backported with AI-assisted adaptation

[ Test Plan ]

Boot tested.

[ Where Problems Could Occur ]

A regression in the netfilter conntrack/NAT SIP helper could corrupt or
mistruncate the Content-Length field during SDP mangling, breaking SIP call
handling or NAT traversal for affected connections. Any error in the buffer
sizing or scnprintf conversion would be confined to the SIP application-layer
helper path.