CVE-2026-23455
CriticalCVSS 9.1Exploitation Probability (EPSS)
Elevated risk68th percentile - higher than 68% of all known CVEs
Summary
In the Linux kernel, the netfilter nf_conntrack_h323 DecodeQ931() function fails to check for zero length before decrementing, causing an integer wrap and out-of-bounds read.
Risk Assessment
An attacker can remotely crash the system or leak memory by sending a crafted H.323 packet.
Recommendation
Apply the Linux kernel patch that adds a length check in DecodeQ931().
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() In DecodeQ931(), the UserUserIE code path reads a 16-bit length from the packet, then decrements it by 1 to skip the protocol discriminator byte before passing it to DecodeH323_UserInformation(). If the encoded length is 0, the decrement wraps to -1, which is then passed as a large value to the decoder, leading to an out-of-bounds read. Add a check to ensure len is positive after the decrement.