The nf_conntrack_h323 module in the Linux kernel contains a flaw in DecodeQ931(). The function reads a 16‑bit length from the packet, decrements it to skip a protocol discriminator byte, and passes the result to DecodeH323_UserInformation(). If the original length is zero, the decrement underflows to –1, which the decoder interprets as a large positive number, leading to an out-of-bounds read into kernel memory. The attacker can trigger the wrap by sending a crafted H.323 packet. The vulnerability allows an attacker to read arbitrary kernel memory without executing code or causing a crash.

All Linux kernel releases that include the nf_conntrack_h323 module and lack the commit adding the zero‑length check are vulnerable. Vendor: Linux. Product: Linux kernel. Specific affected versions are not enumerated in the advisory; any kernel prior to the patch that processes H.323 traffic via nf_conntrack is susceptible.

The CVSS v3 score of 9.1 indicates medium‑to‑high severity. The EPSS score is below 1% and the issue is not listed in the CISA KEV catalog, suggesting a low probability of exploitation. The flaw is reachable over the network, as the nf_conntrack module processes inbound H.323 traffic. An attacker who can inject crafted packets to the target can trigger the out-of-bounds read, leading to possible information disclosure. No privilege escalation, code execution, or denial of service is achieved.