CVE-2026-23455: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23455 is an out-of-bounds read vulnerability in the Linux kernel's nf_conntrack_h323 netfilter module, specifically in the DecodeQ931() function. The flaw affects Linux kernel versions from 2.6.17 through multiple stable branches, with fixed versions including 5.10.253, 5.15.203, 6.1.167, 6.6.130, 6.12.78, 6.18.20, 6.19.10, and later. It was published on April 3, 2026, and has a CVSS v3.1 base score of 9.1 (Critical) (GitHub Advisory, Feedly).

The root cause is an integer underflow (CWE-125: Out-of-bounds Read) in DecodeQ931() within the nf_conntrack_h323 netfilter module. When processing H.323 Q.931 signaling packets, the function reads a 16-bit UserUserIE length field from the packet and decrements it by 1 to skip the protocol discriminator byte before passing it to DecodeH323_UserInformation(). If the encoded length is 0, the decrement wraps to -1 (0xFFFF when treated as unsigned), which is then interpreted as a very large value by the downstream decoder, causing an out-of-bounds read beyond the intended packet buffer into kernel memory. No authentication or user interaction is required — a remote attacker can trigger this by sending a specially crafted H.323 packet to a system with the nf_conntrack_h323 module loaded (GitHub Advisory, Feedly).

Successful exploitation allows an unauthenticated remote attacker to read sensitive kernel memory contents beyond the intended packet buffer, potentially disclosing confidential data such as cryptographic keys, process memory, or other kernel structures. Additionally, the out-of-bounds read can cause a kernel panic or system crash, resulting in a denial of service. The vulnerability has high confidentiality and availability impact with no integrity impact, and affects any Linux system with the nf_conntrack_h323 module active and H.323 traffic reachable (Feedly).

1. Reconnaissance: Identify target systems running Linux with the nf_conntrack_h323 kernel module loaded and H.323 port 1720 accessible from the network (e.g., using Shodan, Censys, or nmap).
2. Craft malicious packet: Construct a Q.931 H.323 signaling packet containing a UserUserIE information element with a length field set to 0.
3. Send packet to target: Transmit the crafted packet to the target system on TCP port 1720 (H.323 call signaling), which will be processed by the nf_conntrack_h323 netfilter module.
4. Trigger integer underflow: The DecodeQ931() function reads the zero-length field and decrements it by 1, causing an integer underflow to 0xFFFF (65535 as unsigned).
5. Out-of-bounds read: The inflated length value is passed to DecodeH323_UserInformation(), which reads far beyond the packet buffer into kernel memory, potentially disclosing sensitive data or triggering a kernel panic/denial of service (GitHub Advisory, Feedly).

• Network: Unexpected or malformed H.323 Q.931 signaling packets arriving on TCP port 1720 with a UserUserIE length field of 0; unusual traffic patterns targeting port 1720 from external or untrusted sources.
• Logs: Kernel log messages (via dmesg or /var/log/kern.log) indicating kernel BUG, general protection fault, or out-of-bounds access in nf_conntrack_h323 or related netfilter modules; kernel oops or panic traces referencing DecodeQ931 or DecodeH323_UserInformation.
• System: Unexpected system crashes or reboots on systems with H.323 conntrack enabled; increased kernel memory read errors or SLUB/SLAB allocator warnings in system logs.

Update the Linux kernel to a patched version: 5.10.253, 5.15.203, 6.1.167, 6.6.130, 6.12.78, 6.18.20, 6.19.10, or later. Patches are available via the stable kernel tree and have been incorporated into distributions including Red Hat (RHSA-2026:21556, RHSA-2026:21557, RHSA-2026:21706, RHSA-2026:21745), SUSE (SUSE-SU-2026:2068-1, SUSE-SU-2026:2217-1, SUSE-SU-2026:2238-1), AlmaLinux, Amazon Linux 2023, and Debian. As a workaround, disable the nf_conntrack_h323 module if H.323 protocol tracking is not required (modprobe -r nf_conntrack_h323), or restrict network access to H.323 port 1720 using firewall rules (GitHub Advisory, Red Hat Errata, SUSE Advisory).

The vulnerability was announced via the Linux kernel CVE mailing list and quickly picked up by major Linux distribution vendors including Red Hat, SUSE, AlmaLinux, Amazon Linux, Debian, and the Yocto Project, all of whom issued security advisories and patches. Tenable published multiple Nessus detection plugins for the vulnerability. No notable independent researcher commentary or significant social media discussion has been identified beyond standard vendor patch notifications.