CVE-2026-80634

netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag

State: Published
Severity: 9.8 Critical
Published: Aug 28, 2026
Updated: Oct 30, 2026
Reserved: Aug 26, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag

The DEV_PATH_BR_VLAN_UNTAG case post-decrements info->num_encaps inside WARN_ON_ONCE(). num_encaps is u8, so if it's already 0 the decrement still happens and wraps it to 255. The break only leaves the inner switch -- a later path entry can set info->indev back to a real device, and we end up returning with num_encaps == 255.

nft_dev_forward_path() then walks info.encap[] (size 2) up to num_encaps, which means an OOB stack read and a bogus count copied into the route descriptor.

Should only happen on a malformed bridge path stack, hence the WARN, but worth handling sanely. Move the decrement out of the WARN.

[ While at this, remove the WARN_ON_ONCE since this can only happen with a buggy bridge path stack --pablo ].

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	e990cef6516daa4e1e236433579e333f74fd38cb to before 9a4e3a9017ba3da2de187b72ed6545641a0d0a84Affected e990cef6516daa4e1e236433579e333f74fd38cb to before 1b52aeb40c9f04bf50eeb4ea09142139d163e239Affected e990cef6516daa4e1e236433579e333f74fd38cb to before ee8440bb000fff4ef8acbfc99652851e9ca0a35bAffected e990cef6516daa4e1e236433579e333f74fd38cb to before 547ea9f567498e4accc89e7816264f15a1a0629fAffected e990cef6516daa4e1e236433579e333f74fd38cb to before 2f55fa28011c97d6495d5787808db10a8c2d690dAffected e990cef6516daa4e1e236433579e333f74fd38cb to before e052f920773b73be49eb4d8702a9f85de7464363Affected
LinuxLinux	5.13Affected before 5.13Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.114 through 6.12.Not affected 6.18.57 through 6.18.Not affected 7.1.5 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

e990cef6516daa4e1e236433579e333f74fd38cb to before 9a4e3a9017ba3da2de187b72ed6545641a0d0a84Affected
e990cef6516daa4e1e236433579e333f74fd38cb to before 1b52aeb40c9f04bf50eeb4ea09142139d163e239Affected
e990cef6516daa4e1e236433579e333f74fd38cb to before ee8440bb000fff4ef8acbfc99652851e9ca0a35bAffected
e990cef6516daa4e1e236433579e333f74fd38cb to before 547ea9f567498e4accc89e7816264f15a1a0629fAffected
e990cef6516daa4e1e236433579e333f74fd38cb to before 2f55fa28011c97d6495d5787808db10a8c2d690dAffected
e990cef6516daa4e1e236433579e333f74fd38cb to before e052f920773b73be49eb4d8702a9f85de7464363Affected

LinuxLinux

5.13Affected
before 5.13Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.114 through 6.12.*Not affected
6.18.57 through 6.18.*Not affected
7.1.5 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.