CVE-2026-43233: netfilter: nf_conntrack_h323: fix OOB read in decode_choice()
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nfconntrackh323: fix OOB read in decodechoice()
In decodechoice(), the boundary check before getlen() uses the variable len, which is still 0 from its initialization at the top of the function:
unsigned int type, ext, len = 0; ... if (ext || (son->attr & OPEN)) { BYTEALIGN(bs); if (nfh323errorboundary(bs, len, 0)) / len is 0 here / return H323ERRORBOUND; len = getlen(bs); / OOB read /
When the bitstream is exactly consumed (bs->cur == bs->end), the check nfh323errorboundary(bs, 0, 0) evaluates to (bs->cur + 0 > bs->end), which is false. The subsequent getlen() call then dereferences bs->cur++, reading 1 byte past the end of the buffer. If that byte has bit 7 set, getlen() reads a second byte as well.
This can be triggered remotely by sending a crafted Q.931 SETUP message with a User-User Information Element containing exactly 2 bytes of PER-encoded data ({0x08, 0x00}) to port 1720 through a firewall with the nfconntrackh323 helper active. The decoder fully consumes the PER buffer before reaching this code path, resulting in a 1-2 byte heap-buffer-overflow read confirmed by AddressSanitizer.
Fix this by checking for 2 bytes (the maximum that getlen() may read) instead of the uninitialized len. This matches the pattern used at every other getlen() call site in the same file, where the caller checks for 2 bytes of available data before calling getlen().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In netfilter: nf_conntrack_h323, update decode_choice() so that the boundary check before calling get_len() verifies 2 bytes of available data (since get_len() may read up to 2 bytes) when the bitstream may be exactly consumed (bs->cur == bs->end).
Linux kernel netfilter nf_conntrack_h323 decode_choice() boundary check before get_len() = Check for 2 bytes available before calling get_len() - Configuration
In nf_conntrack_h323 decode_choice(), change the boundary check to call nf_h323_error_boundary(bs, 0, 0) (using len initialized to 0) instead of using an uninitialized `len`, and ensure the subsequent get_len() dereference is guarded by the corrected boundary logic.
Linux kernel netfilter nf_conntrack_h323 len parameter to nf_h323_error_boundary() = Use initialized len instead of uninitialized value
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43233?
CVE-2026-43233 has been classified as a high-severity vulnerability due to its potential for causing out-of-bounds reads.
How do I fix CVE-2026-43233?
To fix CVE-2026-43233, update your Linux kernel to the latest version that includes the patch for this vulnerability.
What systems are affected by CVE-2026-43233?
CVE-2026-43233 affects systems using the netfilter nf_conntrack_h323 module in the Linux kernel.
What are the consequences of exploiting CVE-2026-43233?
Exploitation of CVE-2026-43233 could lead to unprivileged information disclosure due to out-of-bounds read vulnerabilities.
Is there a workaround for CVE-2026-43233?
There are no known workarounds for CVE-2026-43233 other than patching the affected software.