CVE-2026-23455: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931()
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nfconntrackh323: check for zero length in DecodeQ931()
In DecodeQ931(), the UserUserIE code path reads a 16-bit length from the packet, then decrements it by 1 to skip the protocol discriminator byte before passing it to DecodeH323UserInformation(). If the encoded length is 0, the decrement wraps to -1, which is then passed as a large value to the decoder, leading to an out-of-bounds read.
Add a check to ensure len is positive after the decrement.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In DecodeQ931(), add a check to ensure the 16-bit length read from the byte is positive after the decrement: if length is 0, skip/return without decrementing (prevent wrap to -1) before calling DecodeH323_UserInformation().
netfilter: nf_conntrack_h323 DecodeQ931() length handling = if length == 0, do not decrement; add a zero-length check before decrementing and passing length to DecodeH323_UserInformation()
Event History
Frequently Asked Questions
What must an attacker be able to do to trigger the issue?
An attacker must be able to send a crafted H.323/Q.931 packet that is processed by the kernel's nf_conntrack_h323 netfilter helper. The malformed packet encodes a zero UserUserIE length, causing the length adjustment to underflow before decoding.
What is the practical impact if the vulnerable path is reached?
The underflow turns the length into a large value and can cause an out-of-bounds read in the decoder. The supplied severity vector indicates high confidentiality and availability impact, with no integrity impact specified.