CVE-2026-80634 Overview
CVE-2026-80634 is an integer underflow vulnerability in the Linux kernel's netfilter flowtable subsystem. The flaw resides in the bridge VLAN untag handling path where the DEV_PATH_BR_VLAN_UNTAG case post-decrements info->num_encaps inside a WARN_ON_ONCE() macro. Because num_encaps is a u8, decrementing a zero value wraps it to 255. A subsequent call to nft_dev_forward_path() then walks the fixed-size info.encap[] array (size 2) up to num_encaps, producing an out-of-bounds stack read and a corrupted route descriptor.
Critical Impact
Attackers with the ability to trigger a malformed bridge path stack can cause out-of-bounds stack reads in the kernel, potentially leading to information disclosure, memory corruption, or denial of service.
Affected Products
- Linux kernel with netfilter flowtable support enabled
- Kernel builds using bridge VLAN untagging in flowtable forward paths
- Distributions shipping affected upstream kernel versions prior to the fix commits
Discovery Timeline
- 2026-08-28 - CVE-2026-80634 published to NVD
- 2026-08-29 - Last updated in NVD database
Technical Details for CVE-2026-80634
Vulnerability Analysis
The vulnerability lives in the netfilter flowtable code that resolves forward paths across bridge devices. When the kernel walks a bridge path stack and encounters a DEV_PATH_BR_VLAN_UNTAG entry, the original code decrements the encapsulation counter inside a WARN_ON_ONCE() expression. The WARN is intended to catch impossible states, but the decrement still executes on the pathological input. This produces an unsigned integer underflow on a u8 field, wrapping the counter from 0 to 255.
The break statement only exits the inner switch, so path walking continues. A later entry can reassign info->indev to a real device, causing the function to return successfully with num_encaps == 255. Downstream, nft_dev_forward_path() iterates the fixed-size stack array info.encap[] up to num_encaps, reading well past its two-element bound.
Root Cause
The root cause is placing a state-mutating expression inside WARN_ON_ONCE() without guarding against the underflow condition. The u8 type provides no natural signed-underflow trap, and the loop condition consuming num_encaps performs no bounds check against the encap array size.
Attack Vector
Triggering the flaw requires a malformed bridge path stack reaching the flowtable forward path resolver. Once triggered, the kernel performs out-of-bounds stack reads and copies bogus encapsulation counts into the route descriptor. The upstream fix, referenced in commits 2f55fa28011c and e052f920773b, moves the decrement out of the WARN and removes the WARN_ON_ONCE entirely, since the condition can only arise from a buggy bridge path stack.
Detection Methods for CVE-2026-80634
Indicators of Compromise
- Unexpected kernel WARN traces referencing nft_dev_forward_path or flowtable bridge VLAN handling
- Kernel panics or oops entries in dmesg correlated with netfilter flowtable offload activity
- Unusual bridge forwarding failures on hosts using nftables flowtable with VLAN-tagged bridge ports
Detection Strategies
- Audit running kernel versions against the fixed commits 2f55fa28011c97d6495d5787808db10a8c2d690d and e052f920773b73be49eb4d8702a9f85de7464363
- Monitor kernel logs for stack traces originating in nft_dev_forward_path() or flowtable path resolution code
- Correlate netfilter offload errors with hosts configured to bridge VLAN-tagged traffic through nftables flowtables
Monitoring Recommendations
- Forward kernel dmesg and journalctl -k output to a centralized logging platform for anomaly review
- Alert on new kernel WARN or BUG entries on Linux hosts running netfilter flowtable offload
- Track host kernel versions and package inventory to identify unpatched systems at scale
How to Mitigate CVE-2026-80634
Immediate Actions Required
- Inventory Linux hosts running affected kernel versions with netfilter flowtable and bridge VLAN configurations
- Apply distribution kernel updates that include the upstream fix commits as soon as they are available
- Restrict local access to hosts capable of programming bridge and nftables configurations while patches are staged
Patch Information
The upstream fix is delivered in two kernel commits that move the num_encaps decrement outside the WARN_ON_ONCE() macro and remove the warning entirely. Apply vendor kernel packages incorporating commit 2f55fa28011c and commit e052f920773b.
Workarounds
- Disable netfilter flowtable offload on affected hosts if it is not required for production traffic
- Avoid bridging VLAN-tagged interfaces through nftables flowtables on unpatched kernels
- Limit administrative access to network namespace and nftables configuration surfaces to trusted operators
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
