Loading vulnerability…
Out-of-bounds read in Linux kernel H.323 connection tracking
CVE-2026-23455 is an out-of-bounds read vulnerability in the Linux kernel's Netfilter nf_conntrack_h323 component. In the UserUserIE processing path, DecodeQ931() reads a 16-bit packet length and decrements it by one to skip the protocol discriminator byte. An encoded length of zero becomes -1 and is passed as a large length to DecodeH323_UserInformation(), allowing reads beyond the valid input buffer. The vulnerable code was introduced in Linux 2.6.17. Exploitation could cause denial of service or potentially disclose sensitive kernel memory.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Malformed H.323 traffic can trigger an out-of-bounds read in kernel context, potentially causing a kernel fault and denial of service or exposing sensitive memory. Arbitrary code execution, privilege escalation, and integrity compromise are not established. Exploitability assessments differ: the general CVSS assessment describes unauthenticated network exploitation, whereas Red Hat assesses exploitation as requiring local access and low privileges.
If you can’t patch tonight, do this now.
No vulnerability-specific temporary workaround is documented.
Patch, then assume compromise.
Install the latest supported stable kernel or the applicable distribution kernel security update, then reboot into the corrected kernel. Upstream fixed releases include 6.1.167, 6.6.130, 6.12.78, 6.18.20, 6.19.10, and 7.0-rc5. The fix checks that the UserUserIE length remains positive after decrementing it, before invoking DecodeH323_UserInformation(). Distribution kernels may contain backported fixes without matching these upstream version numbers. The Linux kernel CVE team recommends updating to a current stable release rather than cherry-picking individual fixes.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
41 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.