LiveActive security incident?Get immediate response
CVE Record

CVE-2026-23455: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931()

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() In DecodeQ931(), the UserUserIE code path reads a 16-bit length from the packet, then decrements it by 1 to skip the protocol discriminator byte before passing it to DecodeH323_UserInformation(). If the encoded length is 0, the decrement wraps to -1, which is then passed as a large value to the decoder, leading to an out-of-bounds read. Add a check to ensure len is positive after the decrement.

CriticalCVSS 9.1Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysiscritical

Security readout for executives and security teams

Plain-English summary

A malformed H.323 call-signaling packet can trigger an out-of-bounds read in vulnerable Linux kernels performing H.323 connection tracking. The supplied CVSS rates potential confidentiality and availability impact as high. Systems not using this netfilter helper are less likely to expose the vulnerable path.

Executive priority

Treat exposed H.323-aware Linux gateways as an urgent patching priority because exploitation requires no credentials or user action. Do not assume every Linux server is equally exposed. Require rapid inventory, vendor-version confirmation, controlled rollout, and evidence that corrected kernels are active.

Technical view

DecodeQ931() reads a 16-bit UserUserIE length and subtracts one for the protocol discriminator. An encoded zero wraps to a negative value that the downstream H.323 decoder treats as a large length, causing an out-of-bounds read. The kernel fix rejects non-positive length after subtraction.

Likely exposure

Exposure is most plausible on Linux firewalls, gateways, or other systems where nf_conntrack_h323 processes untrusted H.323/Q.931 traffic. The supplied version data spans multiple kernel branches but does not reliably map every distribution package. Confirm exposure through kernel configuration, runtime use, and vendor backport status.

Exploitation context

The supplied CVSS 3.1 score is 9.1 with network access, low complexity, no privileges, and no user interaction. However, the bundle marks KEV false and provides no evidence of active exploitation, public proof-of-concept availability, or confirmed attacks.

Researcher notes

The defect is an integer underflow leading to an out-of-bounds read, not a source-confirmed code-execution primitive. Practical reachability depends on the H.323 conntrack helper receiving the relevant Q.931 UserUserIE path. The bundle does not establish exact crash, disclosure, or exploit reliability. Distribution backports may invalidate version-only conclusions.

Mitigation direction

  • Apply a vendor-supported kernel update containing the relevant stable fix for the deployed branch.
  • Reboot into the corrected kernel, unless the vendor confirms equivalent live-patch coverage.
  • If patching is delayed, consult vendor guidance about safely disabling unused H.323 connection tracking.
  • Prioritize exposed gateways and systems processing H.323 traffic from untrusted networks.

Validation and detection

  • Inventory systems loading or configuring nf_conntrack_h323 and identify untrusted H.323 traffic paths.
  • Map each running kernel package to its vendor advisory or applicable stable fix commit.
  • Confirm the corrected kernel is running after remediation, not merely installed.
  • Review kernel monitoring for faults temporally associated with H.323 traffic.
  • Use only vendor-provided safe checks within authorized, isolated testing.
Prepared
Confidence
medium
Sources
10

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-23455 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Critical
CVSS
9.1 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
1ADP providers
11Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
9.1CVSS 3.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H3.95.2Linux

Vulnerability scoring details

Base CVSS 3.1 score

9.1Critical
CVSS 3.1 vector shape for CVE-2026-23455Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

siemens-SADPADP container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux5e35941d990123f155b02d5663e51a24f816b6f3, 5e35941d990123f155b02d5663e51a24f816b6f3, 5e35941d990123f155b02d5663e51a24f816b6f3, 5e35941d990123f155b02d5663e51a24f816b6f3, 5e35941d990123f155b02d5663e51a24f816b6f3, 5e35941d990123f155b02d5663e51a24f816b6f3, 5e35941d990123f155b02d5663e51a24f816b6f3, 5e35941d990123f155b02d5663e51a24f816b6f3unaffected
LinuxLinux2.6.17, 0, 5.10.253, 5.15.203, 6.1.167, 6.6.130, 6.12.78, 6.18.20, 6.19.10, 7.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.