ACK: [SRU][Q][PATCH 0/1] CVE-2026-52986

[Edoardo Canepa]

Acked-by: Edoardo Canepa <edoardo.canepa at canonical.com>

On 7/16/26 16:07, Cengiz Can via kernel-team wrote:
> https://ubuntu.com/security/CVE-2026-52986
>
> [ Impact ]
>
> The nf_conntrack_sip connection tracking helper parsed SIP port numbers using
> simple_strtoul(), which assumes NUL-terminated strings, and dereferenced
> pointers without bounds checks after sip_parse_addr(). When operating on non-
> NUL-terminated skb data in epaddr_len(), ct_sip_parse_header_uri(), and
> ct_sip_parse_request(), this could lead to reads past the buffer limit on
> malformed SIP packets. An attacker able to send crafted SIP traffic could
> exploit this to trigger out-of-bounds access in the kernel.
>
> [ Fix ]
>
> questing: clean cherry-pick
> focal: clean cherry-pick
> bionic: clean cherry-pick
> xenial: backported with AI-assisted adaptation
> trusty: backported with AI-assisted adaptation
>
> [ Test Plan ]
>
> Boot tested.
>
> [ Where Problems Could Occur ]
>
> The fix makes SIP port parsing stricter in the netfilter nf_conntrack_sip
> helper, so malformed or unusually formatted (but previously accepted) SIP
> messages may no longer be tracked, potentially affecting NAT traversal for some
> SIP setups. Any regression would be confined to connection tracking of SIP
> traffic.
>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_0x20F88172E14F6784.asc
Type: application/pgp-keys
Size: 3167 bytes
Desc: OpenPGP public key
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20260729/f50bdb7c/attachment.key>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 840 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20260729/f50bdb7c/attachment.sig>