Junglewise Threat Intelligence

CVE-2026-23455: Linux Kernel out-of-bounds read in netfilter nf_conntrack_h323

CVE-2026-23455 · Severity: critical · CVSS 9.1 · Published 2026-04-03

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability exists in the Linux kernel's H.323 protocol handler, which is used to manage multimedia communications like voice and video over IP. An attacker could send a specially crafted network packet to trigger an out-of-bounds memory read. This could lead to a system crash or the exposure of sensitive information from the system's memory.

Technical details

An out-of-bounds read vulnerability exists in the netfilter nf_conntrack_h323 module within the DecodeQ931() function. The UserUserIE code path reads a 16-bit length from a packet and decrements it by 1 to skip a protocol discriminator byte. If the initial length is 0, the decrement results in an integer wrap-around to a large positive value, which is subsequently passed to DecodeH323_UserInformation(). This allows a remote, unauthenticated attacker to trigger an out-of-bounds read via the network. The issue has been addressed by adding a check to ensure the length remains positive after the decrement.

Affected products

  • Linux Linux Kernel 2.6.17 to 5.10.253, 5.11 to 5.15.203, 5.16 to 6.1.167, 6.2 to 6.6.130, 6.7 to 6.12.78, 6.13 to 6.18.20, 6.19 to 6.19.10, 7.0-rc1 to 7.0-rc4

Timeline

  • 2026-03-12: other: Vulnerability fixed in source code
  • 2026-04-03: disclosed: CVE published by kernel.org
  • 2026-04-03: advisory
  • 2026-04-18: patched: Patches applied to various stable kernel branches

References