CVE-2026-23455

A flaw was found in the Linux kernel's netfilter subsystem, specifically within the nf_conntrack_h323 module. This vulnerability occurs in the DecodeQ931() function when processing a zero-length value from a packet. An integer underflow during a length calculation results in a large, incorrect value being passed to a subsequent function, leading to an out-of-bounds read. This could allow an attacker to cause a denial of service or potentially disclose sensitive information.

This vulnerability is rated as Moderate because the nf_conntrack_h323 module is not loaded by default and automatic helper assignment is disabled in standard Red Hat Enterprise Linux environments. A system is only exposed if administrators have explicitly enabled H.323 connection tracking to inspect or route VoIP traffic. Under these non-default conditions, processing a malformed packet can trigger an out-of-bounds read that may result in a kernel crash or restricted memory disclosure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.