An out‑of‑bounds read in the nf_conntrack_h323 helper of the Linux kernel constitutes a CWE‑125 weakness, where an uninitialized length variable causes a boundary check to be performed incorrectly. Additionally, the uninitialized variable itself represents a CWE‑131 weakness. When a Q.931 SETUP packet with a specific User‑User Information Element is received, the decoder’s boundary check fails to detect the end of the buffer, allowing the helper to read one or two bytes beyond the allowed heap region. This can leak adjacent kernel memory contents and can also trigger a kernel crash. While the flaw does not enable arbitrary code execution, the loss of kernel memory integrity and the possibility of a crash compromise confidentiality and availability.

All Linux kernel builds that contain the nf_conntrack_h323 helper are affected. The vulnerability is present in the generic Linux kernel and is not limited to a specific distribution version. Any kernel that has not applied the patch that corrects the length check before get_len is vulnerable.

An attacker can trigger the flaw by sending a crafted Q.931 SETUP packet to a host with the nf_conntrack_h323 helper enabled. Because the helper operates in kernel space, the out‑of‑bounds read occurs before user‑space handling. The CVSS score of 8.2 indicates high severity. The EPSS score of < 1% indicates a very low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. With no authentication required and a purely network‑based trigger, the exploit remains feasible from remote hosts, potentially leading to memory disclosure and kernel crashes that compromise availability.