CVE-2026-23456: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23456 is an out-of-bounds read vulnerability in the Linux kernel's netfilter subsystem, specifically in the nf_conntrack_h323 module's decode_int() function. A malformed H.323/RAS packet can trigger a 1–4 byte slab-out-of-bounds read, potentially disclosing sensitive kernel memory or causing a denial of service. The vulnerability was published on April 3, 2026, and affects Linux kernel versions from 2.6.17 through multiple stable branches up to 7.0-rc4. It carries a CVSS v3.1 base score of 8.2 (High) (GitHub Advisory, Feedly).

The root cause is classified as CWE-125 (Out-of-bounds Read). In decode_int(), the CONS case calls get_bits(bs, 2) to read a 2-bit length value (len), then immediately calls get_uint(bs, len) to read 1–4 bytes without first verifying that len bytes remain in the buffer. The existing boundary check only covers the 2-bit get_bits() read, leaving the subsequent get_uint() call unguarded. An unauthenticated, remote attacker can exploit this by sending a crafted H.323/RAS packet over the network — no privileges or user interaction are required. The fix adds a boundary check for len bytes after get_bits() and before get_uint() (GitHub Advisory, Kernel Patch).

Successful exploitation can result in partial disclosure of kernel memory contents (confidentiality impact) and a potential denial of service through kernel instability caused by the out-of-bounds slab read (availability impact). There is no integrity impact. Because the vulnerability is reachable via network-facing H.323/RAS traffic without authentication, any system with the nf_conntrack_h323 module loaded and H.323 traffic permitted is at risk. Kernel memory disclosure could potentially expose sensitive data such as pointers or credentials residing in adjacent slab memory (Feedly, GitHub Advisory).

1. Reconnaissance: Identify target systems running vulnerable Linux kernel versions (2.6.17 through affected branches) with the nf_conntrack_h323 module loaded and H.323/RAS traffic permitted through the firewall. Tools such as Shodan or Censys can be used to locate internet-facing systems with H.323 (UDP/TCP port 1719 for RAS) exposed.
2. Craft malformed H.323/RAS packet: Construct a malformed H.323/RAS packet where the CONS-encoded integer field contains a length value (len) that exceeds the remaining bytes in the buffer, causing get_uint(bs, len) to read beyond the allocated slab region.
3. Transmit the packet: Send the crafted packet to the target system's H.323 RAS port (typically UDP 1719). The nf_conntrack_h323 netfilter module will process the packet during connection tracking.
4. Trigger OOB read: The decode_int() function reads the 2-bit length via get_bits(), then calls get_uint() without bounds checking, causing a 1–4 byte slab-out-of-bounds read in kernel memory.
5. Achieve objective: Depending on the memory layout, the attacker may observe kernel memory disclosure (e.g., via error responses or side channels) or trigger a kernel panic/crash resulting in denial of service (GitHub Advisory, Feedly).

• Network: Unexpected or malformed H.323/RAS packets (UDP/TCP port 1719) arriving from untrusted external sources; anomalous traffic patterns targeting H.323 connection tracking on perimeter or internal firewalls.
• Logs: Kernel logs (dmesg, /var/log/kern.log) showing slab memory errors, BUG reports, or kernel oops/panics originating from nf_conntrack_h323 or decode_int; netfilter connection tracking errors related to H.323.
• Process/System: Unexpected kernel crashes or system reboots; elevated kernel error rates in monitoring systems; SLUB/SLAB allocator warnings in kernel logs referencing nf_conntrack_h323.
• File System: No specific file artifacts expected for this network-based kernel vulnerability; however, core dump files (/var/crash/, /proc/sys/kernel/core_pattern) may be generated following a kernel panic.

Apply the upstream kernel patches available for all affected stable branches. Fixed versions include: 5.10.253, 5.15.203, 6.1.167, 6.6.130, 6.12.78, 6.18.20, 6.19.10, and 7.0-rc5 (GitHub Advisory). Distribution-specific updates have been released by Amazon Linux (ALAS2023-2026-1594, ALAS2023-2026-1681), SUSE (SUSE-SU-2026:2068-1, SUSE-SU-2026:2217-1, SUSE-SU-2026:2238-1), Debian, and others (Amazon Linux, SUSE Advisory). As a workaround where immediate patching is not possible, apply firewall or network segmentation rules to block H.323/RAS traffic (UDP/TCP port 1719) from untrusted sources, or unload the nf_conntrack_h323 kernel module if H.323 connection tracking is not required (modprobe -r nf_conntrack_h323).

The vulnerability was announced via the Linux kernel CVE mailing list and picked up by multiple security tracking platforms including Tenable (Nessus plugins 311335, 311340, 317729, 318102, 318240, 319659) and Qualys (762889, 762916, 762925) (Tenable). Distribution maintainers for Amazon Linux, SUSE, Debian, and Yocto Project responded promptly with security advisories and updated packages. Community discussion was observed on Mastodon (infosec.pub, mastodon.social) and federated platforms, reflecting routine but attentive coverage typical of Linux kernel CVEs. No extraordinary researcher commentary or significant media coverage beyond standard vulnerability tracking was identified.