CVE-2026-23456

Name of the Vulnerable Software and Affected Versions Linux kernel versions 5.10 through 6.19

Description An out-of-bounds read exists in the H.323 connection tracking parser within the netfilter module. The issue occurs in the decode int() function during the CONS case, where the system calls get bits(bs, 2) to read a length value and subsequently calls get uint(bs, len) without verifying if the required len bytes remain in the buffer. This allows a remotely triggerable attack where a malformed H.323/RAS packet sent to port 1720 can cause a 1-4 byte slab-out-of-bounds read. This memory leak could potentially be used to defeat KASLR (Kernel Address Space Layout Randomization) by leaking kernel pointers, ASLR secrets, or cryptographic material from slab memory. The vulnerability is reachable without authentication, privileges, or user interaction on Linux-based firewalls or NAT gateways that load the nf conntrack h323 module.

Recommendations For Linux kernel versions 5.10 through 6.19, apply the official patch that adds a boundary check for len bytes after the get bits() call and before the get uint() call in the decode int() function. As a temporary mitigation, restrict access to port 1720 or disable the nf conntrack h323 module if H.323 connection tracking is not required.