CVE-2026-23456 netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case
A malformed H.323 packet can trigger an out-of-bounds read in the Linux kernel's netfilter module, potentially leaking memory or causing a crash.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-23456?
CVE-2026-23456 is a high-severity memory corruption vulnerability in Linux kernel, published on 3 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case
In decode_int(), the CONS case calls get_bits(bs, 2) to read a length value, then calls get_uint(bs, len) without checking that len bytes remain in the buffer. The existing boundary check only validates the 2 bits for get_bits(), not the subsequent 1-4 bytes that get_uint() reads. This allows a malformed H.323/RAS packet to cause a 1-4 byte slab-out-of-bounds read.
Add a boundary check for len bytes after get_bits() and before get_uint().
Weakness: CWE-125
Which versions are affected by CVE-2026-23456?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-23456?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-23456 being exploited?
There is no known exploitation of CVE-2026-23456 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-23456, DEBIAN-CVE-2026-23456, GHSA-qgh9-fcm6-v6pg, ROOT-OS-DEBIAN-11-CVE-2026-23456, ROOT-OS-DEBIAN-12-CVE-2026-23456, ROOT-OS-DEBIAN-13-CVE-2026-23456 and 3 more.