PT-2026-4852 · Linux · Linux Kernel
CVE-2026-23456
·
Published
2026-01-26
·
Updated
2026-07-21
CVSS v3.1
8.2
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions 5.10 through 6.19
Description
An out-of-bounds read exists in the Linux kernel's H.323 connection tracking parser within the
nf conntrack h323 module. The issue occurs in the decode int() function during the CONS case. Specifically, the function calls get bits(bs, 2) to read a length value and subsequently calls get uint(bs, len) without verifying if the required len bytes remain in the buffer. While a boundary check exists for the initial 2 bits, it does not validate the subsequent 1-4 bytes read by get uint(). This allows a remotely triggerable slab-out-of-bounds read of 1-4 bytes when a malformed H.323/RAS packet is sent to port 1720 of a Linux firewall or NAT gateway. This memory leak could potentially expose kernel pointers, ASLR secrets, or cryptographic material, which may be used to defeat KASLR (Kernel Address Space Layout Randomization), a security feature that randomizes the location of kernel code in memory to make exploitation harder.Recommendations
Update the Linux kernel to a version where the boundary check for
len bytes has been added between the get bits() and get uint() calls in the decode int() function.
As a temporary workaround, restrict access to port 1720 or disable the nf conntrack h323 module to minimize the risk of exploitation.Exploit
Fix
RCE
Out of bounds Read
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Linux Kernel