CVE-2026-80634

Received Received - Intake

Integer Underflow in Linux Kernel Netfilter Flowtable

Publication date: 2026-08-28

Last updated on: 2026-08-29

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag The DEV_PATH_BR_VLAN_UNTAG case post-decrements info->num_encaps inside WARN_ON_ONCE(). num_encaps is u8, so if it's already 0 the decrement still happens and wraps it to 255. The break only leaves the inner switch -- a later path entry can set info->indev back to a real device, and we end up returning with num_encaps == 255. nft_dev_forward_path() then walks info.encap[] (size 2) up to num_encaps, which means an OOB stack read and a bogus count copied into the route descriptor. Should only happen on a malformed bridge path stack, hence the WARN, but worth handling sanely. Move the decrement out of the WARN. [ While at this, remove the WARN_ON_ONCE since this can only happen with a buggy bridge path stack --pablo ].

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-08-29

Generated

2026-09-18

AI Q&A

2026-08-28

EPSS Evaluated

2026-09-15

NVD

CVE-2026-80634

EUVD

EUVD-2026-67510

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves an underflow issue in the netfilter flowtable when handling bridge VLAN untagged packets. The num_encaps counter, which tracks encapsulation levels, is decremented incorrectly when it is already zero, causing it to wrap around to 255. This leads to an out-of-bounds stack read when processing the encapsulation array, potentially resulting in memory corruption or incorrect routing decisions.

Detection Guidance

This vulnerability involves a Linux kernel flowtable issue with bridge VLAN untagging. Detection requires checking kernel logs for flowtable-related warnings or errors, particularly involving num_encaps underflow or OOB stack reads. Use commands like dmesg | grep -i flowtable or journalctl -k | grep -i flowtable to inspect kernel logs for suspicious activity.

Impact Analysis

If exploited, this vulnerability could allow an attacker to cause a denial of service, crash the system, or potentially execute arbitrary code with kernel privileges. It may also lead to network misconfigurations or unauthorized access to sensitive data due to incorrect packet handling in the kernel.

Compliance Impact

This vulnerability could impact compliance by compromising system integrity, leading to unauthorized data access or disclosure. If exploited, it may violate confidentiality requirements under GDPR or HIPAA, potentially resulting in legal penalties or data breach notifications.

Mitigation Strategies

Immediate mitigation involves updating the Linux kernel to a patched version that resolves this issue. Check your distribution's security advisories for kernel updates. If no patch is available, consider disabling flowtable features temporarily or applying kernel patches manually from upstream sources.

Hi! I’m here to help you understand CVE-2026-80634. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70