LiveActive security incident?Get immediate response
CVE Record

CVE-2026-23456: netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case In decode_int(), the CONS case calls get_bits(bs, 2) to read a length value, then calls get_uint(bs, len) without checking that len bytes remain in the buffer. The existing boundary check only validates the 2 bits for get_bits(), not the subsequent 1-4 bytes that get_uint() reads. This allows a malformed H.323/RAS packet to cause a 1-4 byte slab-out-of-bounds read. Add a boundary check for len bytes after get_bits() and before get_uint().

HighCVSS 8.2Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A malformed H.323/RAS network packet can make an affected Linux kernel read beyond an allocated memory buffer. The flaw requires no privileges or user interaction and may disrupt systems processing this traffic. The supplied CVSS score is 8.2, but the source bundle provides no evidence of active exploitation.

Executive priority

Prioritize internet-facing or network-edge systems that inspect H.323/RAS traffic, then assess remaining Linux and embedded appliances. Patch promptly under normal high-severity procedures. Escalate where the helper is reachable from untrusted networks or updates are unavailable; current sources do not justify an emergency response based on active exploitation.

Technical view

The nf_conntrack_h323 decode_int() CONS path reads a two-bit length, then consumes one to four bytes without verifying they remain available. This causes a small slab out-of-bounds read. The kernel fixes add the missing bounds check before get_uint(). CVSS 3.1 rates it 8.2: network-accessible, low complexity, unauthenticated, with high availability impact.

Likely exposure

Exposure is most likely on affected Linux systems where the nf_conntrack_h323 connection-tracking helper processes reachable H.323/RAS traffic. The supplied version information is ambiguous and should not be treated as a reliable distribution package matrix. Confirm kernel package status, helper presence, and fix inclusion with each Linux or appliance vendor.

Exploitation context

The CVSS vector describes remote, low-complexity, unauthenticated exploitation without user interaction. However, the bundle does not document public exploitation, proof-of-concept availability, or observed attacks, and KEV is false. Practical reachability depends on whether the affected helper is present and processes attacker-controlled H.323/RAS traffic.

Researcher notes

The vulnerable sequence validates only the two bits consumed by get_bits(), not the subsequent length-controlled get_uint() read. The over-read is limited to one through four bytes according to the description. Multiple stable-tree commits indicate backports, but the bundle does not map them cleanly to distribution kernels or establish exploitability beyond the stated out-of-bounds read and CVSS impacts.

Mitigation direction

  • Install a vendor-supported kernel update containing the applicable stable fix.
  • Check Linux distribution and appliance advisories for package-specific remediation guidance.
  • Restrict untrusted H.323/RAS traffic where operationally feasible.
  • Disable the affected helper if unnecessary and vendor-supported.

Validation and detection

  • Record running kernel and installed package versions across Linux systems and appliances.
  • Determine whether nf_conntrack_h323 is present, enabled, or used in production traffic paths.
  • Verify the vendor kernel includes the applicable referenced stable commit.
  • Confirm compensating network controls restrict untrusted H.323/RAS traffic.
  • After updating, verify systems boot normally and required H.323 services still function.
Prepared
Confidence
medium
Sources
10

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-23456 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
8.2 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
1ADP providers
11Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
8.2CVSS 3.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H3.94.2Linux

Vulnerability scoring details

Base CVSS 3.1 score

8.2High
CVSS 3.1 vector shape for CVE-2026-23456Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

siemens-SADPADP container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux5e35941d990123f155b02d5663e51a24f816b6f3, 5e35941d990123f155b02d5663e51a24f816b6f3, 5e35941d990123f155b02d5663e51a24f816b6f3, 5e35941d990123f155b02d5663e51a24f816b6f3, 5e35941d990123f155b02d5663e51a24f816b6f3, 5e35941d990123f155b02d5663e51a24f816b6f3, 5e35941d990123f155b02d5663e51a24f816b6f3, 5e35941d990123f155b02d5663e51a24f816b6f3unaffected
LinuxLinux2.6.17, 0, 5.10.253, 5.15.203, 6.1.167, 6.6.130, 6.12.78, 6.18.20, 6.19.10, 7.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.