CVE-2026-80634

What it actually does

u8 underflow of num_encaps in netfilter flowtable bridge VLAN untag path wraps to 255, causing nft_dev_forward_path to perform out-of-bounds stack read while walking a two-element encap array and copy a bogus count into the route descriptor.

Why it matters to the business

Linux systems performing bridge VLAN operations with flowtables face risk of memory corruption that can lead to remote code execution or information disclosure, potentially disrupting network services and requiring urgent kernel updates across many deployments.

How an attack unfolds

An attacker supplies network traffic or configuration that produces a malformed bridge path stack; the vulnerable decrement inside the WARN_ON_ONCE triggers the u8 wrap, nft_dev_forward_path then iterates beyond the encap array bounds, enabling stack memory disclosure or corruption that can be leveraged for code execution.

How to fix it

Upgrade the Linux kernel to a version containing the fix that moves the num_encaps decrement outside the WARN and removes the WARN_ON_ONCE entirely; rebuild and reboot affected systems.

How to confirm the fix worked

Inspect the netfilter flowtable source for the corrected decrement placement outside any WARN macro; verify the running kernel reports a version after the published fix date and test bridge VLAN untag paths under load.

Typical attack path

1. Craft or trigger bridge VLAN untag configuration on a flowtable-enabled Linux bridge
2. Cause the DEV_PATH_BR_VLAN_UNTAG case to execute with num_encaps already zero
3. Trigger the post-decrement inside WARN_ON_ONCE to wrap num_encaps to 255
4. Invoke nft_dev_forward_path which walks the encap array using the wrapped count
5. Read or corrupt adjacent stack memory to achieve code execution or information leak

How to detect it

Search kernel logs and audit records for netfilter flowtable warnings or stack traces involving num_encaps, bridge VLAN untag, or nft_dev_forward_path; examine crash dumps for abnormal encap array access patterns.

What your security team should do

• Prioritize kernel updates on all systems using netfilter flowtables with bridges
• Monitor for bridge path stack warnings in kernel logs until patches are applied
• Review network configurations that enable flowtable offload on bridged VLAN interfaces
• Test patched kernels in staging environments with representative bridge VLAN traffic