SB2026040668 - Out-of-bounds read in Linux kernel netfilter

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026040668

SB2026040668 - Out-of-bounds read in Linux kernel netfilter

Published: April 6, 2026

Security Bulletin ID SB2026040668
Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Information disclosure

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 security vulnerability.


1) Out-of-bounds read (CVE-ID: CVE-2026-23455)

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in DecodeQ931() in the nf_conntrack_h323 netfilter component when parsing a crafted Q.931 packet with a zero UserUserIE length field. A remote attacker can send a specially crafted packet to disclose sensitive information.

The issue occurs because a 16-bit length value is decremented by 1 to skip the protocol discriminator byte, and an encoded length of 0 wraps to -1 and is then passed to DecodeH323_UserInformation() as a large value.


Remediation

Install update from vendor's website.

References