Affects widely used Linux kernel; remote exploit path via nf_conntrack_h323 could disrupt services across many environments.
CVE-2026-43233
Remote OOB read in nf_conntrack_h323 may crash kernel via crafted Q.931.
Is CVE-2026-43233 being exploited?
Not confirmed. CVE-2026-43233 does not appear in CISA's Known Exploited Vulnerabilities catalog, which records only exploitation that has been observed and reported publicly. That is evidence of absence of a report, not evidence the flaw is unattacked. EPSS currently estimates a 0.46% probability of exploitation in the next 30 days.
How severe is CVE-2026-43233?
CVE-2026-43233 is rated High with a CVSS score of 8.2. Severity describes how bad exploitation would be, not how likely it is: pair it with exploitation evidence before deciding what to patch first.
Is there a patch for CVE-2026-43233?
Yes. A fix has been recorded for CVE-2026-43233. The vendor advisory is the authority on the exact fixed version — apply it from there rather than from a summary.
What does CVE-2026-43233 affect?
CVE-2026-43233 affects Linux kernel (netfilter nf_conntrack_h323). Confirm the exact affected versions against the vendor advisory before deciding you are exposed.
What should I do about CVE-2026-43233?
Update kernel to patched version; reboot.
Exploitation status reflects CISA's KEV catalog as we last synced it. Check the catalog directly.
Remote attacker can trigger via crafted Q.931; kernel crash or memory corruption may enable escalation.
Patch when possible
- affected>= ec8a8f3c31ddef0a7d9626c4b8a4baa30f3b80aa and < bcb50aa0b8f2b74a9fe5a1c7bee6f2657a288041
- affected>= ec8a8f3c31ddef0a7d9626c4b8a4baa30f3b80aa and < 2a3aac4205e7d2f1aca2e3827de8cdd517d36c4a
- affected>= ec8a8f3c31ddef0a7d9626c4b8a4baa30f3b80aa and < 81f2fc5b0d0cf4696146f00f837596d10b92dead
- affected>= ec8a8f3c31ddef0a7d9626c4b8a4baa30f3b80aa and < 7ef82863d42261817a6394c6c881bd6757a70f16
- affected>= ec8a8f3c31ddef0a7d9626c4b8a4baa30f3b80aa and < 53d32735d77ab56cc3fc7bd53a7d099418f19be1
- affected>= ec8a8f3c31ddef0a7d9626c4b8a4baa30f3b80aa and < f0a83d0a4b7c127d32ac06d607a9214937716129
- affected>= ec8a8f3c31ddef0a7d9626c4b8a4baa30f3b80aa and < 35f1943d242e1b9f0b6e91c0c93bfb293a9f8224
- affected>= ec8a8f3c31ddef0a7d9626c4b8a4baa30f3b80aa and < baed0d9ba91d4f390da12d5039128ee897253d60
- affected4.15
As published in the CVE Program record. A version outside these ranges is not a statement that it is unaffected — vendors sometimes understate a range, and distribution-backported builds carry upstream numbers that do not reflect what was patched into them.