CVE-2026-43233 Overview
CVE-2026-43233 is an out-of-bounds read vulnerability in the Linux kernel's netfilter subsystem, specifically within the nf_conntrack_h323 connection tracking helper. The flaw resides in the decode_choice() function, where a boundary check uses an uninitialized-state variable (len = 0) before calling get_len(). When the bitstream is fully consumed, the check fails to detect the exhausted buffer and get_len() reads 1 to 2 bytes past the end of a heap allocation. The condition was confirmed by AddressSanitizer and can be triggered remotely through a crafted Q.931 SETUP message sent to TCP port 1720 across a firewall running the H.323 conntrack helper.
Critical Impact
Remote attackers can trigger a heap-buffer-overflow read in kernel memory by sending a crafted H.323 packet through firewalls running the nf_conntrack_h323 helper, potentially leaking kernel data or destabilizing the host.
Affected Products
- Linux kernel versions containing the nf_conntrack_h323 helper prior to the fix commits
- Firewall and gateway distributions enabling H.323 connection tracking
- Any system loading the nf_conntrack_h323 module on the network path
Discovery Timeline
- 2026-05-06 - CVE-2026-43233 published to NVD
- 2026-05-06 - Last updated in NVD database
Technical Details for CVE-2026-43233
Vulnerability Analysis
The nf_conntrack_h323 helper parses Packed Encoding Rules (PER) data carried inside H.323 signaling. Inside decode_choice(), the local variable len is initialized to 0 and only assigned after the boundary check. The conditional nf_h323_error_boundary(bs, len, 0) therefore evaluates bs->cur + 0 > bs->end, which returns false when the bitstream pointer has already reached the end of the buffer.
The call to get_len() then dereferences *bs->cur++, reading one byte beyond the allocation. If the leaked byte has bit 7 set, get_len() reads a second byte to construct a multi-byte length, extending the overflow to two bytes. This represents an Out-of-Bounds Read [CWE-125] in kernel address space.
Root Cause
The root cause is the use of an uninitialized length value in the boundary precondition check. The correct guard must reserve space for the maximum number of bytes get_len() may consume — two bytes — matching the pattern already used at every other get_len() call site in the same source file. The bug is fixed by replacing the len argument with a constant 2.
Attack Vector
An unauthenticated remote attacker sends a crafted Q.931 SETUP message containing a User-User Information Element with exactly two bytes of PER-encoded data ({0x08, 0x00}) to TCP port 1720. The packet must traverse a firewall or gateway with the nf_conntrack_h323 helper active. The decoder fully consumes the PER buffer before reaching the vulnerable code path, after which get_len() reads 1 to 2 bytes past the heap allocation. No authentication or local access is required.
No public exploit code is available. The vulnerability mechanism is described in the upstream commit messages referenced below; readers should consult those commits for the exact diff.
Detection Methods for CVE-2026-43233
Indicators of Compromise
- Unexpected kernel KASAN or AddressSanitizer reports referencing decode_choice or get_len in the nf_conntrack_h323 module
- Inbound TCP connections to port 1720 from untrusted sources, particularly carrying short or malformed Q.931 SETUP payloads
- Kernel log entries indicating conntrack helper parsing errors or H323_ERROR_BOUND events at elevated rates
Detection Strategies
- Inspect network traffic for Q.931 SETUP messages with truncated User-User Information Elements (notably 2-byte payloads such as 08 00)
- Audit loaded kernel modules across the fleet for nf_conntrack_h323 and verify kernel build versions against the patch commits
- Correlate firewall logs and conntrack events to identify hosts processing H.323 traffic from external networks
Monitoring Recommendations
- Alert on any inbound H.323 signaling reaching internal hosts that do not require voice or video gateway functions
- Track kernel oops, panic, and KASAN telemetry from Linux endpoints and forward it to a central data lake for correlation
- Monitor for new module loads of nf_conntrack_h323 on systems where it has not historically been present
How to Mitigate CVE-2026-43233
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced in the Linux Kernel Commit 35f1943 and related stable backports
- Unload the nf_conntrack_h323 helper module on systems that do not require H.323 inspection
- Block inbound TCP port 1720 at the network perimeter unless H.323 services are explicitly required
Patch Information
The fix replaces the uninitialized len argument in the boundary check with the constant 2, ensuring get_len() is only called when at least two bytes remain in the bitstream. Patches are distributed across stable trees in the following commits: Linux Kernel Commit 2a3aac4, Linux Kernel Commit 35f1943, Linux Kernel Commit 53d3273, Linux Kernel Commit 7ef8286, Linux Kernel Commit 81f2fc5, Linux Kernel Commit baed0d9, Linux Kernel Commit bcb50aa, and Linux Kernel Commit f0a83d0.
Workarounds
- Disable the H.323 conntrack helper using modprobe -r nf_conntrack_h323 and prevent automatic loading via /etc/modprobe.d/blacklist-h323.conf
- Remove any nftables or iptables CT rules that assign the h323 helper to traffic
- Restrict TCP port 1720 traffic to known H.323 endpoints using strict firewall ACLs
# Disable and blacklist the nf_conntrack_h323 helper
sudo modprobe -r nf_conntrack_h323
echo 'blacklist nf_conntrack_h323' | sudo tee /etc/modprobe.d/blacklist-h323.conf
# Block inbound H.323 signaling at the host firewall
sudo iptables -A INPUT -p tcp --dport 1720 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
