Kernel panic via oversized H.323 extension bitmap

Improper input validation in the Linux H.323 conntrack helper allows remote attackers to panic the kernel through a crafted packet. During RAS-message decoding, get_bitmap accepts an extension-bitmap length above 32 and repeatedly uses it as a shift count until the count becomes negative, invoking undefined behavior. The crash requires the H.323 conntrack helper to process the traffic and a kernel built with the shift sanitizer in trap mode; otherwise the malformed message is misparsed without a reported confidentiality or integrity impact.