CVE-2026-100070
Linux kernel: information disclosure
- Risk score
- 43/100
- CVSS
- 5.5 v3.1
- Exploit chance (30 days)
- 0.1%
- Published
- 25 Sep 2026
Open in the live forecast Today's forecast
What to know
- What it is
- In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_nat_sip: rewind offset when NAT shrinks the packet sashiko says: If map_addr() changes the packet length, such as when the public NAT IP string is shorter or longer than the internal IP, coff will still point to the offset relative to th…
- Affected
- Linux kernel
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Story map
At a glance
Linux kernel: Amber, patch this week. In the Linux kernel, the following vulnerability has been resolved: sctp: fix a TOCTOU race in SCTP_CMD_TIMER_START The SCTP_CMD_TIMER_START handler checks timer_pending() before calling timer_reduce(). The timer can expire and detach between these operations, causing timer_reduce() to rearm the timer without taking t…
The flaws
- CVE-2026-100070: Information disclosure (CVSS 5.5 · EPSS 0%)
- CVE-2026-98130: Race condition (CVSS 8.1 · EPSS 0%)
- CVE-2026-98115: Race condition (CVSS 8.8 · EPSS 0%)
- CVE-2026-98052: In the Linux kernel, the following vulnerability has been resolved: net: bcmasp: clear txcb->last… (CVSS 7.8 · EPSS 0%)
The fix
Fix: Apply the vendor's security update; see the linked advisory.
Who is exposed: Linux kernel
Where it stands
- No known exploitation
Connects to
- Same weakness: Race condition (CWE-362). 93 other warnings in 30 days
- Same product: Earlier Linux kernel warnings. 61 in the last 90 days
Why it is Yellow
- CVSS 5.5 medium
- On your watchlist: linux kernel
References
- https://git.kernel.org/stable/c/0f4d30e2e49f343fc28ba1e259fd22969b940c46
- https://git.kernel.org/stable/c/16aecbe3036f6097c26b51b12e4c1cf207769690
- https://git.kernel.org/stable/c/2703f5ea8d85bc729f433ac09ee902084c947122
- https://git.kernel.org/stable/c/668cc1c30caedc63070b10d17d5514748988a140
- https://git.kernel.org/stable/c/6828aca3d82717c2fda92af81c0dda642bc2b465
- https://git.kernel.org/stable/c/810da5a63549531da78348b0a4545042d84e01e2
- https://git.kernel.org/stable/c/c408d416618ebb8a95e3097a13f3b793ea9272ee
- https://git.kernel.org/stable/c/e70d48fcf8382581162608a4a322919bfd22aef3
Original description
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_nat_sip: rewind offset when NAT shrinks the packet sashiko says: If map_addr() changes the packet length, such as when the public NAT IP string is shorter or longer than the internal IP, coff will still point to the offset relative to the pre-mangled packet. If the packet shrinks, coff could overshoot the correct position, potentially causing the next ct_sip_parse_header_uri() call to silently skip bytes and miss subsequent Contact headers. Could this lead to a failure to NAT those subsequent headers and leak internal network details?
Last activity 25 Sep 2026. Patch Forecast updates every hour.