High 8.2Published Apr 3, 2026

CVE-2026-23456netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case

Updated under an hour ago (Oct 27, 2026, 11:50 AM ET)

Does this affect you?

It affects Linux and 4 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case In decode_int(), the CONS case calls get_bits(bs, 2) to read a length value, then calls get_uint(bs, len) without checking that len bytes remain in the buffer. The existing boundary check only validates the 2 bits for get_bits(), not the subsequent 1-4 bytes that get_uint() reads. This allows a malformed H.323/RAS packet to cause a 1-4 byte slab-out-of-bounds read. Add a boundary check for len bytes after get_bits() and before get_uint().

CVSS: 8.2 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Weakness (CWE): CWE-125
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 5e35941d990123f155b02d5663e51a24f816b6f3 before a2cd54b9348e485d338b3c132338a4410c99afaf; from 5e35941d990123f155b02d5663e51a24f816b6f3 before c95dc674ebf01ecfb40388b6facfc89b81fed3b7; from 5e35941d990123f155b02d5663e51a24f816b6f3 before 41b417ff73a24b2c68134992cc44c88db27f482d; from 5e35941d990123f155b02d5663e51a24f816b6f3 before 52235bf88159a1ef16434ab49e47e99c8a09ab20; from 5e35941d990123f155b02d5663e51a24f816b6f3 before 774a434f8c9c8602a976b2536f65d0172a07f4d2; from 5e35941d990123f155b02d5663e51a24f816b6f3 before 6bce72daeccca9aa1746e92d6c3d4784e71f2ebb; from 5e35941d990123f155b02d5663e51a24f816b6f3 before fb6c3596823ec5dd09c2123340330d7448f51a59; 5e35941d990123f155b02d5663e51a24f816b6f3 builds before 1e3a3593162c96e8a8de48b1e14f60c3b57fca8a	CNA record
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518f_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP siemens:siplus_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
linux linux_kernel linux:linux_kernel	from 2.6.17 before 5.10.253; from 5.11 before 5.15.203; from 5.16 before 6.1.167; from 6.2 before 6.6.130; from 6.7 before 6.12.78; from 6.13 before 6.18.20; from 6.19 before 6.19.10; 7.0; and 3 more ranges	NVD

References

References

https://git.kernel.org/stable/c/a2cd54b9348e485d338b3c132338a4410c99afaf	patch
https://git.kernel.org/stable/c/c95dc674ebf01ecfb40388b6facfc89b81fed3b7	patch
https://git.kernel.org/stable/c/41b417ff73a24b2c68134992cc44c88db27f482d	patch
https://git.kernel.org/stable/c/52235bf88159a1ef16434ab49e47e99c8a09ab20	patch
https://git.kernel.org/stable/c/774a434f8c9c8602a976b2536f65d0172a07f4d2	patch
https://git.kernel.org/stable/c/6bce72daeccca9aa1746e92d6c3d4784e71f2ebb	patch
https://git.kernel.org/stable/c/fb6c3596823ec5dd09c2123340330d7448f51a59	patch
https://git.kernel.org/stable/c/1e3a3593162c96e8a8de48b1e14f60c3b57fca8a	patch
https://cert-portal.siemens.com/productcert/html/ssa-019113.html
https://cert-portal.siemens.com/productcert/html/ssa-082556.html
1–10 of 11

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.