Linux CVE-2026-23456

The vulnerability resides in the H.323/RAS protocol handler within Linux kernel's netfilter connection tracking module (nf_conntrack_h323). H.323 is a VoIP signaling protocol that uses ASN.1 encoding; the decode_int() function parses ASN.1 constructed (CONS) integer values. The function calls get_bits(bs, 2) to extract a 2-bit length field, then immediately calls get_uint(bs, len) to read the subsequent variable-length integer without validating that len bytes remain in the input buffer. The existing boundary check validates only the 2-bit read, creating a classic out-of-bounds (OOB) condition when len exceeds available buffer space. The root cause is insufficient input validation (CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer / CWE-125: Out-of-bounds Read). Affected CPE: Linux kernel all versions prior to patched releases.