CVE-2026-23456

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-23456
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case In decode_int(), the CONS case calls get_bits(bs, 2) to read a length value, then calls get_uint(bs, len) without checking that len bytes remain in the buffer. The existing boundary check only validates the 2 bits for get_bits(), not the subsequent 1-4 bytes that get_uint() reads. This allows a malformed H.323/RAS packet to cause a 1-4 byte slab-out-of-bounds read. Add a boundary check for len bytes after get_bits() and before get_uint().

8.2 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/1e3a3593162c96e8a8de48b1e14f60c3b57fca8a Patch
https://git.kernel.org/stable/c/41b417ff73a24b2c68134992cc44c88db27f482d Patch
https://git.kernel.org/stable/c/52235bf88159a1ef16434ab49e47e99c8a09ab20 Patch
https://git.kernel.org/stable/c/6bce72daeccca9aa1746e92d6c3d4784e71f2ebb Patch
https://git.kernel.org/stable/c/774a434f8c9c8602a976b2536f65d0172a07f4d2 Patch
https://git.kernel.org/stable/c/a2cd54b9348e485d338b3c132338a4410c99afaf Patch
https://git.kernel.org/stable/c/c95dc674ebf01ecfb40388b6facfc89b81fed3b7 Patch
https://git.kernel.org/stable/c/fb6c3596823ec5dd09c2123340330d7448f51a59 Patch
https://cert-portal.siemens.com/productcert/html/ssa-019113.html
https://cert-portal.siemens.com/productcert/html/ssa-082556.html
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*
History

24 Jul 2026, 22:10

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: netfilter: nf_conntrack_h323: corrección de lectura fuera de límites (OOB) en el caso CONS de decode_int() En decode_int(), el caso CONS llama a get_bits(bs, 2) para leer un valor de longitud, luego llama a get_uint(bs, len) sin comprobar que len bytes permanezcan en el búfer. La comprobación de límites existente solo valida los 2 bits para get_bits(), no los 1-4 bytes subsiguientes que lee get_uint(). Esto permite que un paquete H.323/RAS malformado cause una lectura fuera de límites de slab de 1-4 bytes. Añadir una comprobación de límites para len bytes después de get_bits() y antes de get_uint().

14 Jul 2026, 13:18

Type Values Removed Values Added
References
  • () https://cert-portal.siemens.com/productcert/html/ssa-019113.html -
  • () https://cert-portal.siemens.com/productcert/html/ssa-082556.html -

26 May 2026, 14:41

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/1e3a3593162c96e8a8de48b1e14f60c3b57fca8a - () https://git.kernel.org/stable/c/1e3a3593162c96e8a8de48b1e14f60c3b57fca8a - Patch
References () https://git.kernel.org/stable/c/41b417ff73a24b2c68134992cc44c88db27f482d - () https://git.kernel.org/stable/c/41b417ff73a24b2c68134992cc44c88db27f482d - Patch
References () https://git.kernel.org/stable/c/52235bf88159a1ef16434ab49e47e99c8a09ab20 - () https://git.kernel.org/stable/c/52235bf88159a1ef16434ab49e47e99c8a09ab20 - Patch
References () https://git.kernel.org/stable/c/6bce72daeccca9aa1746e92d6c3d4784e71f2ebb - () https://git.kernel.org/stable/c/6bce72daeccca9aa1746e92d6c3d4784e71f2ebb - Patch
References () https://git.kernel.org/stable/c/774a434f8c9c8602a976b2536f65d0172a07f4d2 - () https://git.kernel.org/stable/c/774a434f8c9c8602a976b2536f65d0172a07f4d2 - Patch
References () https://git.kernel.org/stable/c/a2cd54b9348e485d338b3c132338a4410c99afaf - () https://git.kernel.org/stable/c/a2cd54b9348e485d338b3c132338a4410c99afaf - Patch
References () https://git.kernel.org/stable/c/c95dc674ebf01ecfb40388b6facfc89b81fed3b7 - () https://git.kernel.org/stable/c/c95dc674ebf01ecfb40388b6facfc89b81fed3b7 - Patch
References () https://git.kernel.org/stable/c/fb6c3596823ec5dd09c2123340330d7448f51a59 - () https://git.kernel.org/stable/c/fb6c3596823ec5dd09c2123340330d7448f51a59 - Patch
CPE cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*
CWE CWE-125
First Time Linux
Linux linux Kernel

27 Apr 2026, 14:16

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 8.2

18 Apr 2026, 09:16

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/a2cd54b9348e485d338b3c132338a4410c99afaf -
  • () https://git.kernel.org/stable/c/c95dc674ebf01ecfb40388b6facfc89b81fed3b7 -

03 Apr 2026, 16:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-04-03 16:16

Updated : 2026-07-24 22:10

NVD link : CVE-2026-23456

Mitre link : CVE-2026-23456

CVE.ORG link : CVE-2026-23456

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-125

Out-of-bounds Read