CVE-2026-23455

netfilter: nf_conntrack_h323: check for zero length in DecodeQ931()

State: Published
Severity: 9.1 Critical
Published: Apr 3, 2026
Updated: Oct 19, 2026
Reserved: Jan 13, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_conntrack_h323: check for zero length in DecodeQ931()

In DecodeQ931(), the UserUserIE code path reads a 16-bit length from the packet, then decrements it by 1 to skip the protocol discriminator byte before passing it to DecodeH323_UserInformation(). If the encoded length is 0, the decrement wraps to -1, which is then passed as a large value to the decoder, leading to an out-of-bounds read.

Add a check to ensure len is positive after the decrement.

Scores

CVSS	Score	Vector	Source
3.1	9.1 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H	Linux

Weaknesses

CWE-125 Out-of-bounds Read

Affected Products

Product	Versions
LinuxLinux	5e35941d990123f155b02d5663e51a24f816b6f3 to before 2121f5fbe88daff0f1fc5bc47d359426c74b86b0Affected 5e35941d990123f155b02d5663e51a24f816b6f3 to before 65fa92f79677858b14b9e4b7275f26639afe2710Affected 5e35941d990123f155b02d5663e51a24f816b6f3 to before 495e97af9e7249ee02b72bb1d0848a6efc3700f4Affected 5e35941d990123f155b02d5663e51a24f816b6f3 to before f5e4f4e4cdb75ec36802059a94195a31f193da60Affected 5e35941d990123f155b02d5663e51a24f816b6f3 to before 633e8f87dad32263f6a57dccdb873f042c062111Affected 5e35941d990123f155b02d5663e51a24f816b6f3 to before 9d00fe7d6d7c5b5f1065a6e042b54f2e44bd6df8Affected 5e35941d990123f155b02d5663e51a24f816b6f3 to before b652b05d51003ac074b912684f9ec7486231717bAffected 5e35941d990123f155b02d5663e51a24f816b6f3 to before f173d0f4c0f689173f8cdac79991043a4a89bf66Affected
LinuxLinux	2.6.17Affected before 2.6.17Not affected 5.10.253 through 5.10.Not affected 5.15.203 through 5.15.Not affected 6.1.167 through 6.1.Not affected 6.6.130 through 6.6.Not affected 6.12.78 through 6.12.Not affected 6.18.20 through 6.18.Not affected 6.19.10 through 6.19.*Not affected 7.0 and laterNot affected

Product

Versions

LinuxLinux

5e35941d990123f155b02d5663e51a24f816b6f3 to before 2121f5fbe88daff0f1fc5bc47d359426c74b86b0Affected
5e35941d990123f155b02d5663e51a24f816b6f3 to before 65fa92f79677858b14b9e4b7275f26639afe2710Affected
5e35941d990123f155b02d5663e51a24f816b6f3 to before 495e97af9e7249ee02b72bb1d0848a6efc3700f4Affected
5e35941d990123f155b02d5663e51a24f816b6f3 to before f5e4f4e4cdb75ec36802059a94195a31f193da60Affected
5e35941d990123f155b02d5663e51a24f816b6f3 to before 633e8f87dad32263f6a57dccdb873f042c062111Affected
5e35941d990123f155b02d5663e51a24f816b6f3 to before 9d00fe7d6d7c5b5f1065a6e042b54f2e44bd6df8Affected
5e35941d990123f155b02d5663e51a24f816b6f3 to before b652b05d51003ac074b912684f9ec7486231717bAffected
5e35941d990123f155b02d5663e51a24f816b6f3 to before f173d0f4c0f689173f8cdac79991043a4a89bf66Affected

LinuxLinux

2.6.17Affected
before 2.6.17Not affected
5.10.253 through 5.10.*Not affected
5.15.203 through 5.15.*Not affected
6.1.167 through 6.1.*Not affected
6.6.130 through 6.6.*Not affected
6.12.78 through 6.12.*Not affected
6.18.20 through 6.18.*Not affected
6.19.10 through 6.19.*Not affected
7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.