CVE-2026-23456 PUBLISHED

netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case

Assigner: Linux
Reserved: 13.01.2026 Published: 03.04.2026 Updated: 03.04.2026

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case

In decode_int(), the CONS case calls get_bits(bs, 2) to read a length value, then calls get_uint(bs, len) without checking that len bytes remain in the buffer. The existing boundary check only validates the 2 bits for get_bits(), not the subsequent 1-4 bytes that get_uint() reads. This allows a malformed H.323/RAS packet to cause a 1-4 byte slab-out-of-bounds read.

Add a boundary check for len bytes after get_bits() and before get_uint().

Product Status

Vendor Linux
Product Linux
Versions Default: unaffected
  • affected from 5e35941d990123f155b02d5663e51a24f816b6f3 to 41b417ff73a24b2c68134992cc44c88db27f482d (excl.)
  • affected from 5e35941d990123f155b02d5663e51a24f816b6f3 to 52235bf88159a1ef16434ab49e47e99c8a09ab20 (excl.)
  • affected from 5e35941d990123f155b02d5663e51a24f816b6f3 to 774a434f8c9c8602a976b2536f65d0172a07f4d2 (excl.)
  • affected from 5e35941d990123f155b02d5663e51a24f816b6f3 to 6bce72daeccca9aa1746e92d6c3d4784e71f2ebb (excl.)
  • affected from 5e35941d990123f155b02d5663e51a24f816b6f3 to fb6c3596823ec5dd09c2123340330d7448f51a59 (excl.)
  • affected from 5e35941d990123f155b02d5663e51a24f816b6f3 to 1e3a3593162c96e8a8de48b1e14f60c3b57fca8a (excl.)
Vendor Linux
Product Linux
Versions Default: affected
  • Version 2.6.17 is affected
  • unaffected from 0 to 2.6.17 (excl.)
  • unaffected from 6.1.167 to 6.1.* (incl.)
  • unaffected from 6.6.130 to 6.6.* (incl.)
  • unaffected from 6.12.78 to 6.12.* (incl.)
  • unaffected from 6.18.20 to 6.18.* (incl.)
  • unaffected from 6.19.10 to 6.19.* (incl.)
  • unaffected from 7.0-rc5 to * (incl.)

References