{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-80634", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-26T14:34:25.777Z", "datePublished": "2026-08-28T06:48:49.022Z", "dateUpdated": "2026-10-21T12:46:41.589Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-21T12:46:41.589Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag\n\nThe DEV_PATH_BR_VLAN_UNTAG case post-decrements info->num_encaps\ninside WARN_ON_ONCE(). num_encaps is u8, so if it's already 0 the\ndecrement still happens and wraps it to 255. The break only leaves\nthe inner switch -- a later path entry can set info->indev back to\na real device, and we end up returning with num_encaps == 255.\n\nnft_dev_forward_path() then walks info.encap[] (size 2) up to\nnum_encaps, which means an OOB stack read and a bogus count copied\ninto the route descriptor.\n\nShould only happen on a malformed bridge path stack, hence the WARN,\nbut worth handling sanely. Move the decrement out of the WARN.\n\n[ While at this, remove the WARN_ON_ONCE since this can only happen\n with a buggy bridge path stack --pablo ]." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL" }, "scenarios": [ { "lang": "en", "value": "AV:N - The bug is hit in nft_flow_offload_eval on NF_INET_FORWARD when remotely sourced TCP/UDP packets matching a conntrack flow trigger nft_flow_route() and nft_dev_forward_path() during softirq packet processing on nftables flowtable routers/gateways, not via netlink configuration APIs.\nAC:L - Once an nftables flowtable with bridge VLAN filtering is deployed, an attacker can establish confirmed TCP/UDP flows and steer traffic through the affected bridge/VLAN topology to reach nft_dev_path_info() without races or other conditions outside the attacker's control.\nPR:N - Flowtable and bridge VLAN setup are administrator deployment prerequisites; a remote sender needs no local account, authentication, or CAP_NET_ADMIN on the victim to trigger flow offload path resolution while forwarding traffic through the configured bridge.\nUI:N - Exploitation requires only sending network packets processed automatically on the forwarding path; no victim must open files, mount filesystems, or take any interactive action beyond normal traffic through the router.\nS:U - Out-of-bounds stack reads and writes in nft_dev_forward_path() corrupt kernel stack memory and route descriptors on the affected host only; this is standard kernel compromise within one security authority, not a VM escape or cross-boundary sandbox break.\nC:H - When num_encaps underflows to 255, nft_dev_forward_path() loops up to 255 times over info.encap[2], performing out-of-bounds stack reads of adjacent kernel stack memory that can disclose pointers and other sensitive data.\nI:H - The same loop writes attacker-influenced encap values past route->tuple[].in.encap[2] on the stack, corrupting adjacent route fields and stack data in ways that can be leveraged for arbitrary kernel writes and control-flow hijack.\nA:H - Massive out-of-bounds stack corruption during flow offload setup in softirq context can cause immediate kernel oops/panic and reliable denial of service on forwarding routers processing malicious traffic through vulnerable bridge VLAN paths." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/netfilter/nf_flow_table_path.c" ], "versions": [ { "version": "e990cef6516daa4e1e236433579e333f74fd38cb", "lessThan": "1b52aeb40c9f04bf50eeb4ea09142139d163e239", "status": "affected", "versionType": "git" }, { "version": "e990cef6516daa4e1e236433579e333f74fd38cb", "lessThan": "ee8440bb000fff4ef8acbfc99652851e9ca0a35b", "status": "affected", "versionType": "git" }, { "version": "e990cef6516daa4e1e236433579e333f74fd38cb", "lessThan": "547ea9f567498e4accc89e7816264f15a1a0629f", "status": "affected", "versionType": "git" }, { "version": "e990cef6516daa4e1e236433579e333f74fd38cb", "lessThan": "2f55fa28011c97d6495d5787808db10a8c2d690d", "status": "affected", "versionType": "git" }, { "version": "e990cef6516daa4e1e236433579e333f74fd38cb", "lessThan": "e052f920773b73be49eb4d8702a9f85de7464363", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/netfilter/nf_flow_table_path.c" ], "versions": [ { "version": "5.13", "status": "affected" }, { "version": "0", "lessThan": "5.13", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.114", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.57", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.1.5", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.6.160" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.12.114" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.18.57" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "7.1.5" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "7.2" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/1b52aeb40c9f04bf50eeb4ea09142139d163e239" }, { "url": "https://git.kernel.org/stable/c/ee8440bb000fff4ef8acbfc99652851e9ca0a35b" }, { "url": "https://git.kernel.org/stable/c/547ea9f567498e4accc89e7816264f15a1a0629f" }, { "url": "https://git.kernel.org/stable/c/2f55fa28011c97d6495d5787808db10a8c2d690d" }, { "url": "https://git.kernel.org/stable/c/e052f920773b73be49eb4d8702a9f85de7464363" } ], "title": "netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "id": "CVE-2026-80634", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "yes" }, { "Technical Impact": "total" } ], "version": "2.0.3", "timestamp": "2026-10-16T19:19:08.898847Z" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T19:26:31.432Z" } } ] } }