Junglewise Threat Intelligence

CVE-2026-23456: Linux Kernel Netfilter out-of-bounds read in nf_conntrack_h323

CVE-2026-23456 · Severity: high · CVSS 8.2 · Published 2026-04-03

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's networking component could allow an attacker to cause a system crash or leak small amounts of memory. The issue exists in the H.323 protocol helper, which is used to manage multimedia traffic like VoIP. By sending a specially crafted network packet, an attacker can trigger an out-of-bounds memory read, potentially impacting system stability and availability.

Technical details

An out-of-bounds (OOB) read vulnerability exists in the netfilter: nf_conntrack_h323 component of the Linux kernel, specifically within the decode_int() function's CONS case. The root cause is a missing boundary check: the code reads a length value using get_bits(bs, 2) but fails to verify that the buffer contains enough remaining bytes before calling get_uint(bs, len). An attacker can exploit this by sending a malformed H.323/RAS packet over the network, triggering a 1-4 byte slab-out-of-bounds read. This can result in a kernel oops/denial of service or potentially leak sensitive memory contents. Patches have been released across multiple stable kernel branches.

Affected products

  • Linux Linux Kernel 2.6.17 to 5.10.253, 5.11 to 5.15.203, 5.16 to 6.1.167, 6.2 to 6.6.130, 6.7 to 6.12.78, 6.13 to 6.18.20, 6.19 to 6.19.10, 7.0-rc1 to 7.0-rc4

Timeline

  • 2026-03-12: other: Vulnerability fixed in kernel source
  • 2026-04-03: disclosed: CVE published by kernel.org
  • 2026-04-03: advisory: NVD entry created

References