CVE-2026-43233
Out-of-Bounds Read in Linux Kernel's nf_conntrack_h323
Publication date: 2026-05-06
Last updated on: 2026-05-06
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux_kernel | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's netfilter nf_conntrack_h323 module, specifically in the decode_choice() function. The issue arises because a boundary check uses an uninitialized variable 'len' which is zero at that point, leading to an out-of-bounds (OOB) read when get_len() is called.
When a crafted Q.931 SETUP message with a User-User Information Element containing exactly 2 bytes of PER-encoded data is sent to port 1720 through a firewall with the nf_conntrack_h323 helper active, the decoder consumes the PER buffer fully but then attempts to read 1-2 bytes past the end of the buffer. This results in a heap-buffer-overflow read.
The fix involves properly checking for 2 bytes of available data before calling get_len(), preventing the out-of-bounds read.
How can this vulnerability impact me? :
This vulnerability can lead to a heap-buffer-overflow read, which may cause the affected system to behave unpredictably or crash. Since it can be triggered remotely by sending a crafted message to port 1720, it poses a risk of remote exploitation.
Potential impacts include denial of service or information disclosure due to reading memory beyond the intended buffer.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is fixed by ensuring proper boundary checks before calling get_len() in the nf_conntrack_h323 helper of the Linux kernel netfilter module.
Immediate mitigation steps include updating the Linux kernel to a version that contains the fix for this vulnerability.
Additionally, if possible, disabling the nf_conntrack_h323 helper or blocking traffic on port 1720 (used by H.323) through the firewall can reduce exposure until the patch is applied.