PT-2026-32353 · Linux · Linux Kernel

Published 2026-04-13 · Updated 2026-05-03 · CVE-2026-31427

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description In the netfilter module, the process sdp() function declares a union nf inet addr named rtp addr on the stack. This variable is only initialized when a recognized media type with a non-zero port is found within the SDP media descriptions. If the SDP body contains no media lines, only inactive media sections, or only unrecognized media types, rtp addr remains uninitialized. The function then calls the sdp session() hook with the address of rtp addr, leading nf nat sdp session() to use a stale stack value as an IP address to rewrite the SDP session owner and connection lines. Depending on the system configuration, this results in addresses being rewritten to 0.0.0.0 or random stack data.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use of Uninitialized Resource

Weakness Enumeration

CWE-908

Related Identifiers

CVE-2026-31427

ECHO-BDA3-8CAE-A4BE

OESA-2026-2172

OESA-2026-2173

OESA-2026-2176

Affected Products

Linux Kernel

References · 48

• https://git.kernel.org/stable/c/6a2b724460cb67caed500c508c2ae5cf012e4db4 · Patch
• https://ubuntu.com/security/CVE-2026-31427 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-71089 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-23442 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-23455 · Security Note
• https://git.kernel.org/stable/c/82baeb871e8f04906bc886273fdf0209e1754eb3 · Patch
• https://osv.dev/vulnerability/OESA-2026-2172 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-27558 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-23452 · Security Note
• https://git.kernel.org/stable/c/6e5e3c87b7e6212f1d8414fc2e4d158b01e12025 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-31416 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-23447 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-31427 · Security Note
• https://git.kernel.org/stable/c/52fdda318ef2362fc5936385bcb8b3d0328ee629 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-23449 · Security Note