Kernel buffer overread via unterminated SIP header

Out-of-bounds read in Linux nf_conntrack_sip allows remote attackers to trigger a one-byte kernel overread via malformed SIP traffic. sip_skip_whitespace returns the end pointer rather than NULL after spaces or tabs consume the remaining payload, and ct_sip_get_header then dereferences that pointer while looking for a colon. Reachability requires the SIP connection-tracking helper to parse a recognized header whose whitespace reaches the exact payload end; published evidence establishes the one-byte overread but not data disclosure or code execution.