Junglewise Threat Intelligence

CVE-2026-43233: Linux Kernel out-of-bounds read in nf_conntrack_h323

CVE-2026-43233 · Severity: high · CVSS 8.2 · Published 2026-05-06

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability exists in the Linux kernel's Netfilter component, specifically within the H.323 protocol helper used by firewalls to manage VoIP traffic. An attacker can exploit this by sending specially crafted network messages to a system or firewall running the affected software. This could result in a service disruption (system crash) or the unauthorized reading of small amounts of system memory.

Technical details

An out-of-bounds (OOB) read vulnerability exists in net/netfilter/nf_conntrack_h323_asn1.c within the decode_choice() function. The root cause is an incorrect boundary check that uses an uninitialized variable 'len' (set to 0) before calling get_len(). When the bitstream is fully consumed, the check fails to prevent get_len() from dereferencing the bitstream pointer beyond its allocated buffer. A remote attacker can trigger this by sending a crafted Q.931 SETUP message with a specific User-User Information Element to TCP port 1720 on a system where the nf_conntrack_h323 helper is active. This results in a 1-2 byte heap-buffer-overflow read, which can lead to a kernel panic (DoS) or potentially leak sensitive memory. Patches have been released across multiple stable kernel branches.

Affected products

  • Linux Linux Kernel 4.15.1 to 5.10.252, 5.11 to 5.15.202, 5.16 to 6.1.165, 6.2 to 6.6.128, 6.7 to 6.12.75, 6.13 to 6.18.16, 6.19 to 6.19.6

Timeline

  • 2026-02-25: other: Vulnerability fixed in upstream kernel code
  • 2026-05-06: disclosed: CVE published

References

Related threats