CVE-2026-23456netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case
Updated under an hour ago ()
Does this affect you?
It affects Linux and 4 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case In decode_int(), the CONS case calls get_bits(bs, 2) to read a length value, then calls get_uint(bs, len) without checking that len bytes remain in the buffer. The existing boundary check only validates the 2 bits for get_bits(), not the subsequent 1-4 bytes that get_uint() reads. This allows a malformed H.323/RAS packet to cause a 1-4 byte slab-out-of-bounds read. Add a boundary check for len bytes after get_bits() and before get_uint().
- CVSS
- 8.2 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Modified
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 5e35941d990123f155b02d5663e51a24f816b6f3 before a2cd54b9348e485d338b3c132338a4410c99afaf; from 5e35941d990123f155b02d5663e51a24f816b6f3 before c95dc674ebf01ecfb40388b6facfc89b81fed3b7; from 5e35941d990123f155b02d5663e51a24f816b6f3 before 41b417ff73a24b2c68134992cc44c88db27f482d; from 5e35941d990123f155b02d5663e51a24f816b6f3 before 52235bf88159a1ef16434ab49e47e99c8a09ab20; from 5e35941d990123f155b02d5663e51a24f816b6f3 before 774a434f8c9c8602a976b2536f65d0172a07f4d2; from 5e35941d990123f155b02d5663e51a24f816b6f3 before 6bce72daeccca9aa1746e92d6c3d4784e71f2ebb; from 5e35941d990123f155b02d5663e51a24f816b6f3 before fb6c3596823ec5dd09c2123340330d7448f51a59; 5e35941d990123f155b02d5663e51a24f816b6f3 builds before 1e3a3593162c96e8a8de48b1e14f60c3b57fca8a | CNA record |
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518_4_pn_dp_mfp (from the name) | from V3.1.6 | CISA ADP |
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518f_4_pn_dp_mfp (from the name) | from V3.1.6 | CISA ADP |
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP siemens:siplus_s7_1500_cpu_1518_4_pn_dp_mfp (from the name) | from V3.1.6 | CISA ADP |
linux linux_kernel linux:linux_kernel | from 2.6.17 before 5.10.253; from 5.11 before 5.15.203; from 5.16 before 6.1.167; from 6.2 before 6.6.130; from 6.7 before 6.12.78; from 6.13 before 6.18.20; from 6.19 before 6.19.10; 7.0; and 3 more ranges | NVD |
References
- https://git.kernel.org/stable/c/a2cd54b9348e485d338b3c132338a4410c99afafpatch
- https://git.kernel.org/stable/c/c95dc674ebf01ecfb40388b6facfc89b81fed3b7patch
- https://git.kernel.org/stable/c/41b417ff73a24b2c68134992cc44c88db27f482dpatch
- https://git.kernel.org/stable/c/52235bf88159a1ef16434ab49e47e99c8a09ab20patch
- https://git.kernel.org/stable/c/774a434f8c9c8602a976b2536f65d0172a07f4d2patch
- https://git.kernel.org/stable/c/6bce72daeccca9aa1746e92d6c3d4784e71f2ebbpatch
- https://git.kernel.org/stable/c/fb6c3596823ec5dd09c2123340330d7448f51a59patch
- https://git.kernel.org/stable/c/1e3a3593162c96e8a8de48b1e14f60c3b57fca8apatch
- https://cert-portal.siemens.com/productcert/html/ssa-019113.html
- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
- https://cert-portal.siemens.com/productcert/html/ssa-457936.html
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.