CVE-2026-80634 netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag
An integer underflow in Linux kernel netfilter flowtable handling can cause out-of-bounds stack reads, potentially leading to information disclosure or system crashes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-80634?
CVE-2026-80634 is a critical vulnerability in Linux, published on 28 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag
The DEV_PATH_BR_VLAN_UNTAG case post-decrements info->num_encaps inside WARN_ON_ONCE(). num_encaps is u8, so if it's already 0 the decrement still happens and wraps it to 255. The break only leaves the inner switch -- a later path entry can set info->indev back to a real device, and we end up returning with num_encaps == 255.
nft_dev_forward_path() then walks info.encap[] (size 2) up to num_encaps, which means an OOB stack read and a bogus count copied into the route descriptor.
Should only happen on a malformed bridge path stack, hence the WARN, but worth handling sanely. Move the decrement out of the WARN.
[ While at this, remove the WARN_ON_ONCE since this can only happen with a buggy bridge path stack --pablo ].
Which versions are affected by CVE-2026-80634?
How do I fix CVE-2026-80634?
Apply the vendor's patch.
Is CVE-2026-80634 being exploited?
There is no known exploitation of CVE-2026-80634 in the wild and no public exploit code.
Sources
Also known as AZL-98093, BELL-CVE-2026-80634, DEBIAN-CVE-2026-80634, GHSA-jm3q-xwgv-hgh8, UBUNTU-CVE-2026-80634.