CVE-2026-23455: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931()
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nfconntrackh323: check for zero length in DecodeQ931()
In DecodeQ931(), the UserUserIE code path reads a 16-bit length from the packet, then decrements it by 1 to skip the protocol discriminator byte before passing it to DecodeH323UserInformation(). If the encoded length is 0, the decrement wraps to -1, which is then passed as a large value to the decoder, leading to an out-of-bounds read.
Add a check to ensure len is positive after the decrement.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.14-1 - Compensating control
In netfilter nf_conntrack_h323's DecodeQ931() UserUserIE code path, add a check ensuring the length remains positive after decrementing it to skip the protocol discriminator byte, so an encoded length of 0 is not passed as a large value to DecodeH323_UserInformation().
Event History
Frequently Asked Questions
What must an attacker be able to do to trigger the issue?
An attacker must be able to send a crafted H.323/Q.931 packet that is processed by the kernel's nf_conntrack_h323 netfilter helper. The malformed packet encodes a zero UserUserIE length, causing the length adjustment to underflow before decoding.
What is the practical impact if the vulnerable path is reached?
The underflow turns the length into a large value and can cause an out-of-bounds read in the decoder. The supplied severity vector indicates high confidentiality and availability impact, with no integrity impact specified.