The nf_conntrack_h323 module in the Linux kernel contains a boundary‑check failure in its decode_int() routine. In the CONS case, the routine reads a length value with get_bits(bs,2) and then calls get_uint(bs,len) without validating that len bytes remain on the buffer. This omission permits a crafted H.323/RAS packet to trigger a 1–4 byte out‑of‑bounds read from kernel memory. The flaw is a CWE‑125 boundary‑check failure that can expose privileged kernel data to a remote attacker.

The vulnerability is present in the Linux kernel for all distributions that ship with the nf_conntrack_h323 conntrack module and that have not yet incorporated the patch. The CNA entry lists only Linux:Linux, and no specific versions are enumerated, so every kernel prior to the commit that introduced the boundary check is affected. Users should verify whether their running kernel matches the repositories referenced in the advisory to determine vulnerability status.

The CVSS v3 score of 8.2 indicates high severity. The EPSS score is less than 1%, implying a very low likelihood of exploitation in the wild, and the flaw is not currently listed in the CISA KEV catalog. Exploitation requires an attacker to inject a malformed H.323 packet into the network interface that the kernel processes, so remote access to that interface is needed. Because the read is small, the immediate impact is information disclosure, but the data leaked could aid more complex attacks, so the overall risk remains significant for exposed systems. The likely attack vector is inferred to be a remote network attacker sending crafted H.323 traffic to the target. The vulnerability does not provide a code execution path by itself.