{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-80634 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-80634 is a critical vulnerability in Linux, published on 28 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-80634 and fix it if it is affected.\n\nWhat it is: CVE-2026-80634 is a critical vulnerability in Linux, published on 28 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-80634 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-80634/ (Markdown: https://insights.sbomify.com/CVE-2026-80634/index.md)","id":"CVE-2026-80634","markdown":"https://insights.sbomify.com/CVE-2026-80634/index.md","name":"CVE-2026-80634","record":{"aliases":["AZL-98093","BELL-CVE-2026-80634","DEBIAN-CVE-2026-80634","GHSA-jm3q-xwgv-hgh8","UBUNTU-CVE-2026-80634"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service","data_read"],"network_reachable":"yes","non_default_config":false,"product_category":"Linux kernel netfilter","requires_auth":"none","summary":"An integer underflow in Linux kernel netfilter flowtable handling can cause out-of-bounds stack reads, potentially leading to information disclosure or system crashes.","user_interaction":"not_required","vuln_class":"integer_overflow"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":9.8,"severity":"critical","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag\n\nThe DEV_PATH_BR_VLAN_UNTAG case post-decrements info-\u003enum_encaps\ninside WARN_ON_ONCE(). num_encaps is u8, so if it's already 0 the\ndecrement still happens and wraps it to 255. The break only leaves\nthe inner switch -- a later path entry can set info-\u003eindev back to\na real device, and we end up returning with num_encaps == 255.\n\nnft_dev_forward_path() then walks info.encap[] (size 2) up to\nnum_encaps, which means an OOB stack read and a bogus count copied\ninto the route descriptor.\n\nShould only happen on a malformed bridge path stack, hence the WARN,\nbut worth handling sanely. Move the decrement out of the WARN.\n\n[ While at this, remove the WARN_ON_ONCE since this can only happen\n  with a buggy bridge path stack --pablo ].","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag","id":"CVE-2026-80634","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"integer_overflow","year":"2026"},"n_packages":0,"n_references":5,"next":{"headline":"wifi: wcn36xx: fix OOB read from short trigger BA firmware response","id":"CVE-2026-80635"},"packages":[],"prev":{"headline":"iommufd: Take dma_resv lock before dma_buf_unpin() in release path","id":"CVE-2026-80633"},"products":["Linux"],"published":"2026-08-28","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"yes","exploitation":"none","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-10-21","vendors":["Linux"]},"summary":"An integer underflow in Linux kernel netfilter flowtable handling can cause out-of-bounds stack reads, potentially leading to information disclosure or system crashes.","url":"https://insights.sbomify.com/CVE-2026-80634/"}