CVE-2026-23455

Name of the Vulnerable Software and Affected Versions Linux kernel versions 5.10 through 6.19

Description An out-of-bounds read exists in the H.323 connection tracking parser within the netfilter module. The issue occurs in the DecodeQ931() function during the processing of the UserUserIE code path. The function reads a 16-bit length from a packet and decrements it by 1 to skip the protocol discriminator byte before passing the result to the DecodeH323 UserInformation() function. If the encoded length is 0, the decrement causes the value to wrap to -1. Because this value is interpreted as a large positive integer by the decoder, the kernel may read memory far beyond the packet buffer until it encounters an unmapped page. This can lead to unbounded kernel memory disclosure, potentially exposing kernel pointers, cryptographic keys, or credentials from other processes. The flaw is remotely triggerable via UDP port 1719 or TCP port 1720 without authentication or privileges.

Recommendations Update the Linux kernel to a version where the fix has been applied for versions 5.10 through 6.19. As a temporary mitigation, restrict network access to UDP port 1719 and TCP port 1720 to minimize the risk of exploitation.