CVE-2026-43233 Linux CVE debrief

Who should care

Defenders responsible for Linux kernel security, particularly those with nf_conntrack_h323 helper active, should assess exposure and prioritize patching. This includes operators, platform administrators, vulnerability management teams, and security teams that manage Linux kernel deployments.

Why it matters

This vulnerability allows for remote out-of-bounds reads in the Linux kernel's netfilter component, particularly when nf_conntrack_h323 helper is active. Defenders should verify and apply patches, review firewall configurations, and monitor for suspicious messages.

• Potential for remote information disclosure
• Verification of Linux kernel versions and patch levels required
• Firewall configuration review necessary for nf_conntrack_h323 helper usage
• Monitoring for crafted Q.931 SETUP messages recommended

Technical summary

The vulnerability is caused by an out-of-bounds read in the decode_choice() function of the Linux kernel's netfilter component. This can be triggered by a crafted Q.931 SETUP message with a User-User Information Element containing exactly 2 bytes of PER-encoded data. The decoder fully consumes the PER buffer before reaching this code path, resulting in a 1-2 byte heap-buffer-overflow read. Defenders should prioritize verifying and applying patches for Linux kernel versions affected by this vulnerability, particularly those with nf_conntrack_h323 helper active.

Defensive priority

Defenders should prioritize verifying and applying patches for Linux kernel versions affected by this vulnerability, particularly those with nf_conntrack_h323 helper active.

Recommended defensive actions

• Verify Linux kernel versions and apply patches for affected versions
• Review firewall configurations for nf_conntrack_h323 helper usage
• Monitor for crafted Q.931 SETUP messages
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, affected versions, and references to source code patches. Defenders should verify Linux kernel versions, review firewall configurations for nf_conntrack_h323 helper usage, and monitor for crafted Q.931 SETUP messages. The vulnerability allows for remote out-of-bounds reads in the Linux kernel's netfilter component, particularly when nf_conntrack_h323 helper is active. Evidence is limited to public CVE details and supplied source item data.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.