Critical severity9.1NVD Advisory· Published Apr 3, 2026· Updated May 26, 2026
CVE-2026-23455
CVE-2026-23455
Description
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_conntrack_h323: check for zero length in DecodeQ931()
In DecodeQ931(), the UserUserIE code path reads a 16-bit length from the packet, then decrements it by 1 to skip the protocol discriminator byte before passing it to DecodeH323_UserInformation(). If the encoded length is 0, the decrement wraps to -1, which is then passed as a large value to the decoder, leading to an out-of-bounds read.
Add a check to ensure len is positive after the decrement.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
82cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*+ 5 more
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*range: >=2.6.17,<5.10.253
- cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*
- (no CPE)
- osv-coords76 versionspkg:rpm/almalinux/bpftoolpkg:rpm/almalinux/kernelpkg:rpm/almalinux/kernel-64kpkg:rpm/almalinux/kernel-64k-corepkg:rpm/almalinux/kernel-64k-debugpkg:rpm/almalinux/kernel-64k-debug-corepkg:rpm/almalinux/kernel-64k-debug-develpkg:rpm/almalinux/kernel-64k-debug-devel-matchedpkg:rpm/almalinux/kernel-64k-debug-modulespkg:rpm/almalinux/kernel-64k-debug-modules-corepkg:rpm/almalinux/kernel-64k-debug-modules-extrapkg:rpm/almalinux/kernel-64k-develpkg:rpm/almalinux/kernel-64k-devel-matchedpkg:rpm/almalinux/kernel-64k-modulespkg:rpm/almalinux/kernel-64k-modules-corepkg:rpm/almalinux/kernel-64k-modules-extrapkg:rpm/almalinux/kernel-abi-stablelistspkg:rpm/almalinux/kernel-corepkg:rpm/almalinux/kernel-cross-headerspkg:rpm/almalinux/kernel-debugpkg:rpm/almalinux/kernel-debug-corepkg:rpm/almalinux/kernel-debug-develpkg:rpm/almalinux/kernel-debug-devel-matchedpkg:rpm/almalinux/kernel-debug-modulespkg:rpm/almalinux/kernel-debug-modules-corepkg:rpm/almalinux/kernel-debug-modules-extrapkg:rpm/almalinux/kernel-debug-uki-virtpkg:rpm/almalinux/kernel-develpkg:rpm/almalinux/kernel-devel-matchedpkg:rpm/almalinux/kernel-docpkg:rpm/almalinux/kernel-headerspkg:rpm/almalinux/kernel-modulespkg:rpm/almalinux/kernel-modules-corepkg:rpm/almalinux/kernel-modules-extrapkg:rpm/almalinux/kernel-modules-extra-matchedpkg:rpm/almalinux/kernel-rtpkg:rpm/almalinux/kernel-rt-64kpkg:rpm/almalinux/kernel-rt-64k-corepkg:rpm/almalinux/kernel-rt-64k-debugpkg:rpm/almalinux/kernel-rt-64k-debug-corepkg:rpm/almalinux/kernel-rt-64k-debug-develpkg:rpm/almalinux/kernel-rt-64k-debug-modulespkg:rpm/almalinux/kernel-rt-64k-debug-modules-corepkg:rpm/almalinux/kernel-rt-64k-debug-modules-extrapkg:rpm/almalinux/kernel-rt-64k-develpkg:rpm/almalinux/kernel-rt-64k-modulespkg:rpm/almalinux/kernel-rt-64k-modules-corepkg:rpm/almalinux/kernel-rt-64k-modules-extrapkg:rpm/almalinux/kernel-rt-corepkg:rpm/almalinux/kernel-rt-debugpkg:rpm/almalinux/kernel-rt-debug-corepkg:rpm/almalinux/kernel-rt-debug-develpkg:rpm/almalinux/kernel-rt-debug-modulespkg:rpm/almalinux/kernel-rt-debug-modules-corepkg:rpm/almalinux/kernel-rt-debug-modules-extrapkg:rpm/almalinux/kernel-rt-develpkg:rpm/almalinux/kernel-rt-modulespkg:rpm/almalinux/kernel-rt-modules-corepkg:rpm/almalinux/kernel-rt-modules-extrapkg:rpm/almalinux/kernel-toolspkg:rpm/almalinux/kernel-tools-libspkg:rpm/almalinux/kernel-tools-libs-develpkg:rpm/almalinux/kernel-uki-virtpkg:rpm/almalinux/kernel-uki-virt-addonspkg:rpm/almalinux/kernel-zfcpdumppkg:rpm/almalinux/kernel-zfcpdump-corepkg:rpm/almalinux/kernel-zfcpdump-develpkg:rpm/almalinux/kernel-zfcpdump-devel-matchedpkg:rpm/almalinux/kernel-zfcpdump-modulespkg:rpm/almalinux/kernel-zfcpdump-modules-corepkg:rpm/almalinux/kernel-zfcpdump-modules-extrapkg:rpm/almalinux/libperfpkg:rpm/almalinux/perfpkg:rpm/almalinux/python3-perfpkg:rpm/almalinux/rtlapkg:rpm/almalinux/rv
< 4.18.0-553.126.1.el8_10+ 75 more
- (no CPE)range: < 4.18.0-553.126.1.el8_10
- (no CPE)range: < 5.14.0-687.12.1.el9_8
- (no CPE)range: < 5.14.0-687.12.1.el9_8
- (no CPE)range: < 5.14.0-687.12.1.el9_8
- (no CPE)range: < 5.14.0-687.12.1.el9_8
- (no CPE)range: < 5.14.0-687.12.1.el9_8
- (no CPE)range: < 5.14.0-687.12.1.el9_8
- (no CPE)range: < 5.14.0-687.12.1.el9_8
- (no CPE)range: < 5.14.0-687.12.1.el9_8
- (no CPE)range: < 5.14.0-687.12.1.el9_8
- (no CPE)range: < 5.14.0-687.12.1.el9_8
- (no CPE)range: < 5.14.0-687.12.1.el9_8
- (no CPE)range: < 5.14.0-687.12.1.el9_8
- (no CPE)range: < 5.14.0-687.12.1.el9_8
- (no CPE)range: < 5.14.0-687.12.1.el9_8
- (no CPE)range: < 5.14.0-687.12.1.el9_8
- (no CPE)range: < 5.14.0-687.12.1.el9_8
- (no CPE)range: < 5.14.0-687.12.1.el9_8
- (no CPE)range: < 5.14.0-687.12.1.el9_8
- (no CPE)range: < 5.14.0-687.12.1.el9_8
- (no CPE)range: < 5.14.0-687.12.1.el9_8
- (no CPE)range: < 5.14.0-687.12.1.el9_8
- (no CPE)range: < 5.14.0-687.12.1.el9_8
- (no CPE)range: < 5.14.0-687.12.1.el9_8
- (no CPE)range: < 5.14.0-687.12.1.el9_8
- (no CPE)range: < 5.14.0-687.12.1.el9_8
- (no CPE)range: < 5.14.0-687.12.1.el9_8
- (no CPE)range: < 5.14.0-687.12.1.el9_8
- (no CPE)range: < 5.14.0-687.12.1.el9_8
- (no CPE)range: < 5.14.0-687.12.1.el9_8
- (no CPE)range: < 5.14.0-687.12.1.el9_8
- (no CPE)range: < 5.14.0-687.12.1.el9_8
- (no CPE)range: < 5.14.0-687.12.1.el9_8
- (no CPE)range: < 5.14.0-687.12.1.el9_8
- (no CPE)range: < 6.12.0-211.18.1.el10_2
- (no CPE)range: < 5.14.0-687.12.1.el9_8
- (no CPE)range: < 5.14.0-687.12.1.el9_8
- (no CPE)range: < 5.14.0-687.12.1.el9_8
- (no CPE)range: < 5.14.0-687.12.1.el9_8
- (no CPE)range: < 5.14.0-687.12.1.el9_8
- (no CPE)range: < 5.14.0-687.12.1.el9_8
- (no CPE)range: < 5.14.0-687.12.1.el9_8
- (no CPE)range: < 5.14.0-687.12.1.el9_8
- (no CPE)range: < 5.14.0-687.12.1.el9_8
- (no CPE)range: < 5.14.0-687.12.1.el9_8
- (no CPE)range: < 5.14.0-687.12.1.el9_8
- (no CPE)range: < 5.14.0-687.12.1.el9_8
- (no CPE)range: < 5.14.0-687.12.1.el9_8
- (no CPE)range: < 5.14.0-687.12.1.el9_8
- (no CPE)range: < 5.14.0-687.12.1.el9_8
- (no CPE)range: < 5.14.0-687.12.1.el9_8
- (no CPE)range: < 5.14.0-687.12.1.el9_8
- (no CPE)range: < 5.14.0-687.12.1.el9_8
- (no CPE)range: < 5.14.0-687.12.1.el9_8
- (no CPE)range: < 5.14.0-687.12.1.el9_8
- (no CPE)range: < 5.14.0-687.12.1.el9_8
- (no CPE)range: < 5.14.0-687.12.1.el9_8
- (no CPE)range: < 5.14.0-687.12.1.el9_8
- (no CPE)range: < 5.14.0-687.12.1.el9_8
- (no CPE)range: < 5.14.0-687.12.1.el9_8
- (no CPE)range: < 5.14.0-687.12.1.el9_8
- (no CPE)range: < 5.14.0-687.12.1.el9_8
- (no CPE)range: < 5.14.0-687.12.1.el9_8
- (no CPE)range: < 5.14.0-687.12.1.el9_8
- (no CPE)range: < 5.14.0-687.12.1.el9_8
- (no CPE)range: < 5.14.0-687.12.1.el9_8
- (no CPE)range: < 5.14.0-687.12.1.el9_8
- (no CPE)range: < 5.14.0-687.12.1.el9_8
- (no CPE)range: < 5.14.0-687.12.1.el9_8
- (no CPE)range: < 5.14.0-687.12.1.el9_8
- (no CPE)range: < 5.14.0-687.12.1.el9_8
- (no CPE)range: < 5.14.0-687.12.1.el9_8
- (no CPE)range: < 5.14.0-687.12.1.el9_8
- (no CPE)range: < 5.14.0-687.12.1.el9_8
- (no CPE)range: < 5.14.0-687.12.1.el9_8
- (no CPE)range: < 5.14.0-687.12.1.el9_8
Patches
Vulnerability mechanics
References
8- git.kernel.org/stable/c/2121f5fbe88daff0f1fc5bc47d359426c74b86b0nvdPatch
- git.kernel.org/stable/c/495e97af9e7249ee02b72bb1d0848a6efc3700f4nvdPatch
- git.kernel.org/stable/c/633e8f87dad32263f6a57dccdb873f042c062111nvdPatch
- git.kernel.org/stable/c/65fa92f79677858b14b9e4b7275f26639afe2710nvdPatch
- git.kernel.org/stable/c/9d00fe7d6d7c5b5f1065a6e042b54f2e44bd6df8nvdPatch
- git.kernel.org/stable/c/b652b05d51003ac074b912684f9ec7486231717bnvdPatch
- git.kernel.org/stable/c/f173d0f4c0f689173f8cdac79991043a4a89bf66nvdPatch
- git.kernel.org/stable/c/f5e4f4e4cdb75ec36802059a94195a31f193da60nvdPatch
News mentions
0No linked articles in our index yet.