Linux CVE-2026-23455

The vulnerability exists in the netfilter connection tracking subsystem for H.323 protocol (nf_conntrack_h323), specifically in the DecodeQ931() function which parses Q.931 signaling messages. The H.323 protocol uses Q.931 for call control, and the UserUserIE (User-User Information Element) field contains a 16-bit length prefix. The code decrements this length by 1 to skip the protocol discriminator byte before passing the remaining data to DecodeH323_UserInformation(). When the encoded length in the packet is exactly 0, the decrement operation causes an integer underflow, wrapping the unsigned 16-bit value to 65535 (0xFFFF). This large value is then used as a size parameter to read kernel memory, resulting in an out-of-bounds read beyond allocated buffer boundaries. The root cause is insufficient input validation (CWE-680: Integer Overflow to Buffer Overflow) combined with improper length handling in a packet parsing routine. Affected systems run Linux kernels with the vulnerable nf_conntrack_h323 module active, typically in firewall/NAT configurations.