kernel: netfilter: nf_conntrack_h323: fix OOB read in decode_choice()

A flaw was found in the Linux kernel's nfconntrackh323 helper. A remote attacker could exploit this by sending a specially crafted Q.931 SETUP message to port 1720 through a firewall with the nfconntrackh323 helper active. This memory corruption vulnerability leads to an out-of-bounds read, which...

kernel: netfilter: nf_conntrack_h323: fix OOB read in decode_choice()

A flaw was found in the Linux kernel's nfconntrackh323 helper. A remote attacker could exploit this by sending a specially crafted Q.931 SETUP message to port 1720 through a firewall with the nfconntrackh323 helper active. This memory corruption vulnerability leads to an out-of-bounds read, which...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntrackh323: Fixed an issue where an OOB read was performed in the decodeint function during the CONS case. In decodeint, the CONS case calls getbitsbs, 2 to read a length value. Then, it calls getuintbs, len witho...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntrackh323 – check for zero length in DecodeQ931. In DecodeQ931, the UserUserIE code path reads a 16-bit length from the packet, then decrements it by 1 to skip the protocol discriminator byte before passing it to...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098771)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098771 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntrackh323: check for zero length in DecodeQ931 In DecodeQ931, the UserUserIE cod...

The vulnerability of the DecodeQ931() function in the net/netfilter/nf_conntrack_h323_asn1.c module of the netfilter kernel in the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the DecodeQ931 function in the net/netfilter/nfconntrackh323asn1.c module of the netfilter component in the Linux operating system is related to the issue of data being written outside of the buffer. Exploiting this vulnerability could allow a remote attacker to compromise th...

The vulnerability of the decode_int() function in the net/netfilter/nf_conntrack_h323_asn1.c module of the netfilter component in the Linux operating system allows a attacker to compromise the confidentiality and accessibility of protected information.

The vulnerability of the decodeint function in the net/netfilter/nfconntrackh323asn1.c module of the netfilter component in the Linux operating system is related to reading beyond the buffer boundaries. Exploiting this vulnerability could allow a remote attacker to compromise the confidentiality...

kernel: netfilter: nf_conntrack_h323: fix OOB read in decode_choice()

A flaw was found in the Linux kernel's nfconntrackh323 helper. A remote attacker could exploit this by sending a specially crafted Q.931 SETUP message to port 1720 through a firewall with the nfconntrackh323 helper active. This memory corruption vulnerability leads to an out-of-bounds read, which...

kernel: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931()

A flaw was found in the Linux kernel's netfilter subsystem, specifically within the nfconntrackh323 module. This vulnerability occurs in the DecodeQ931 function when processing a zero-length value from a packet. An integer underflow during a length calculation results in a large, incorrect value...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-100159)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100159 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntrackh323: Add protection for bmp length out of range UBSAN load reports an...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-099717)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099717 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntrackh323: fix OOB read in decodechoice In decodechoice, the boundary check...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100313)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100313 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntrackh323: fix OOB read in decodechoice In decodechoice, the boundary check...

kernel: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931()

A flaw was found in the Linux kernel's netfilter subsystem, specifically within the nfconntrackh323 module. This vulnerability occurs in the DecodeQ931 function when processing a zero-length value from a packet. An integer underflow during a length calculation results in a large, incorrect value...

kernel: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931()

A flaw was found in the Linux kernel's netfilter subsystem, specifically within the nfconntrackh323 module. This vulnerability occurs in the DecodeQ931 function when processing a zero-length value from a packet. An integer underflow during a length calculation results in a large, incorrect value...

CVE-2026-43233

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntrackh323: fix OOB read in decodechoice In decodechoice, the boundary check before getlen uses the variable len, which is still 0 from its initialization at the top of the function: unsigned int type, ext, len = ...

CVE-2026-43233: Out-of-bounds Read

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntrackh323: fix OOB read in decodechoice In decodechoice, the boundary check before getlen uses the variable len, which is still 0 from its initialization at the top of the function: unsigned int type, ext, len = ...

Linux Distros Unpatched Vulnerability : CVE-2026-23455

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntrackh323: check for zero length in DecodeQ931 In DecodeQ931, the UserUserI...

Linux Distros Unpatched Vulnerability : CVE-2026-23456

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - netfilter: nfconntrackh323: fix OOB read in decodeint CONS case In decodeint, the CONS case calls getbitsbs, 2 to read a length value, then calls getuintbs, len...

CVE-2026-23456 netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntrackh323: fix OOB read in decodeint CONS case In decodeint, the CONS case calls getbitsbs, 2 to read a length value, then calls getuintbs, len without checking that len bytes remain in the buffer. The existing...

CVE-2026-23456 netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntrackh323: fix OOB read in decodeint CONS case In decodeint, the CONS case calls getbitsbs, 2 to read a length value, then calls getuintbs, len without checking that len bytes remain in the buffer. The existing...