---
id: CVE-2026-43233
title: 'netfilter: nf_conntrack_h323: fix OOB read in decode_choice()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  netfilter: nf_conntrack_h323: fix OOB read in decode_choice()

  In decode_choice(), the boundary check before get_len() uses the
  variable `len`, which is still 0 from it…
severity: high
cvss: 8.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= ec8a8f3c31ddef0a7d9626c4b8a4baa30f3b80aa <
    bcb50aa0b8f2b74a9fe5a1c7bee6f2657a288041
  - >-
    Linux >= ec8a8f3c31ddef0a7d9626c4b8a4baa30f3b80aa <
    2a3aac4205e7d2f1aca2e3827de8cdd517d36c4a
  - >-
    Linux >= ec8a8f3c31ddef0a7d9626c4b8a4baa30f3b80aa <
    81f2fc5b0d0cf4696146f00f837596d10b92dead
  - >-
    Linux >= ec8a8f3c31ddef0a7d9626c4b8a4baa30f3b80aa <
    7ef82863d42261817a6394c6c881bd6757a70f16
  - >-
    Linux >= ec8a8f3c31ddef0a7d9626c4b8a4baa30f3b80aa <
    53d32735d77ab56cc3fc7bd53a7d099418f19be1
  - >-
    Linux >= ec8a8f3c31ddef0a7d9626c4b8a4baa30f3b80aa <
    f0a83d0a4b7c127d32ac06d607a9214937716129
  - >-
    Linux >= ec8a8f3c31ddef0a7d9626c4b8a4baa30f3b80aa <
    35f1943d242e1b9f0b6e91c0c93bfb293a9f8224
  - >-
    Linux >= ec8a8f3c31ddef0a7d9626c4b8a4baa30f3b80aa <
    baed0d9ba91d4f390da12d5039128ee897253d60
  - Linux 4.15
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-16T15:15:55.935171Z'
published: '2026-05-06'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:20:37.301Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-43233'
references:
  - url: 'https://git.kernel.org/stable/c/bcb50aa0b8f2b74a9fe5a1c7bee6f2657a288041'
  - url: 'https://git.kernel.org/stable/c/2a3aac4205e7d2f1aca2e3827de8cdd517d36c4a'
  - url: 'https://git.kernel.org/stable/c/81f2fc5b0d0cf4696146f00f837596d10b92dead'
  - url: 'https://git.kernel.org/stable/c/7ef82863d42261817a6394c6c881bd6757a70f16'
  - url: 'https://git.kernel.org/stable/c/53d32735d77ab56cc3fc7bd53a7d099418f19be1'
  - url: 'https://git.kernel.org/stable/c/f0a83d0a4b7c127d32ac06d607a9214937716129'
  - url: 'https://git.kernel.org/stable/c/35f1943d242e1b9f0b6e91c0c93bfb293a9f8224'
  - url: 'https://git.kernel.org/stable/c/baed0d9ba91d4f390da12d5039128ee897253d60'
tags:
  - cve.org
epss: 0.00463
epssPercentile: 0.38686
ingestedAt: '2026-10-16T17:24:46.688Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_conntrack_h323: fix OOB read in decode_choice()

In decode_choice(), the boundary check before get_len() uses the
variable `len`, which is still 0 from its initialization at the top of
the function:

    unsigned int type, ext, len = 0;
    ...
    if (ext || (son->attr & OPEN)) {
        BYTE_ALIGN(bs);
        if (nf_h323_error_boundary(bs, len, 0))  /* len is 0 here */
            return H323_ERROR_BOUND;
        len = get_len(bs);                        /* OOB read */

When the bitstream is exactly consumed (bs->cur == bs->end), the check
nf_h323_error_boundary(bs, 0, 0) evaluates to (bs->cur + 0 > bs->end),
which is false.  The subsequent get_len() call then dereferences
*bs->cur++, reading 1 byte past the end of the buffer.  If that byte
has bit 7 set, get_len() reads a second byte as well.

This can be triggered remotely by sending a crafted Q.931 SETUP message
with a User-User Information Element containing exactly 2 bytes of
PER-encoded data ({0x08, 0x00}) to port 1720 through a firewall with
the nf_conntrack_h323 helper active.  The decoder fully consumes the
PER buffer before reaching this code path, resulting in a 1-2 byte
heap-buffer-overflow read confirmed by AddressSanitizer.

Fix this by checking for 2 bytes (the maximum that get_len() may read)
instead of the uninitialized `len`.  This matches the pattern used at
every other get_len() call site in the same file, where the caller
checks for 2 bytes of available data before calling get_len().

## Affected

- `Linux >= ec8a8f3c31ddef0a7d9626c4b8a4baa30f3b80aa < bcb50aa0b8f2b74a9fe5a1c7bee6f2657a288041`
- `Linux >= ec8a8f3c31ddef0a7d9626c4b8a4baa30f3b80aa < 2a3aac4205e7d2f1aca2e3827de8cdd517d36c4a`
- `Linux >= ec8a8f3c31ddef0a7d9626c4b8a4baa30f3b80aa < 81f2fc5b0d0cf4696146f00f837596d10b92dead`
- `Linux >= ec8a8f3c31ddef0a7d9626c4b8a4baa30f3b80aa < 7ef82863d42261817a6394c6c881bd6757a70f16`
- `Linux >= ec8a8f3c31ddef0a7d9626c4b8a4baa30f3b80aa < 53d32735d77ab56cc3fc7bd53a7d099418f19be1`
- `Linux >= ec8a8f3c31ddef0a7d9626c4b8a4baa30f3b80aa < f0a83d0a4b7c127d32ac06d607a9214937716129`
- `Linux >= ec8a8f3c31ddef0a7d9626c4b8a4baa30f3b80aa < 35f1943d242e1b9f0b6e91c0c93bfb293a9f8224`
- `Linux >= ec8a8f3c31ddef0a7d9626c4b8a4baa30f3b80aa < baed0d9ba91d4f390da12d5039128ee897253d60`
- `Linux 4.15`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.