PT-2026-30150 · Linux+2 · Linux Kernel+2
CVE-2026-23455
·
Published
2026-04-03
·
Updated
2026-07-24
CVSS v3.1
9.1
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions 5.10 through 6.19
Description
An out-of-bounds read exists in the H.323 connection tracking parser within the netfilter module. The issue occurs in the
DecodeQ931() function during the processing of Q.931 signaling messages. Specifically, in the UserUserIE code path, the system reads a 16-bit length from a packet and decrements it by 1 to skip the protocol discriminator byte before passing the value to the DecodeH323 UserInformation() function. If the encoded length is 0, the decrement causes the value to wrap to -1. This signed integer is then interpreted as a very large positive value by the decoder, leading to an unbounded read of kernel memory until an unmapped page or parse error is encountered. This can result in the disclosure of sensitive kernel memory, such as crypto keys, credentials, or pointers that could defeat KASLR (Kernel Address Space Layout Randomization), a security feature that randomizes the location of kernel code in memory to make exploitation harder.Recommendations
Update the Linux kernel to a version where the fix is applied for versions 5.10 through 6.19.
As a temporary workaround, restrict access to UDP port 1719 and TCP port 1720 to minimize the risk of exploitation.
Exploit
Fix
DoS
Out of bounds Read
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Linuxmint
Linux Kernel
Rocky Linux