CVE-2026-80634

CVE-2026-80634 is an integer underflow in the Linux kernel's netfilter flowtable code: in the bridge VLAN untag case (DEV_PATH_BR_VLAN_UNTAG), the u8 counter info->num_encaps is post-decremented inside WARN_ON_ONCE() even when it is already zero, wrapping it from 0 to 255. Because the break only exits the inner switch, a later entry on the path stack can set info->indev back to a real device, so nft_dev_forward_path() then walks the two-entry info.encap[] array as if it contained up to 255 entries, causing an out-of-bounds stack read and a bogus encapsulation count copied into the route descriptor. The flaw is triggered when nftables flowtable path resolution encounters a malformed or buggy bridge path stack, notably in bridge VLAN untag scenarios, which the maintainers characterize as an edge case; if reached, it can expose adjacent kernel stack memory and corrupt route metadata, consistent with the critical CVSS 9.8 rating. Potentially affected are systems running a vulnerable Linux kernel with nftables flowtable offloading configured, particularly router, gateway, and appliance deployments where bridged VLAN traffic traverses the flowtable; kernels without a configured flowtable are not reachable by this code path. No public proof-of-concept, CISA KEV listing, or known exploitation exists, and EPSS estimates only a 0.4% probability of exploitation within 30 days.

What to do: Update to a Linux kernel build containing the upstream netfilter flowtable fix (which moves the num_encaps decrement out of WARN_ON_ONCE and removes the WARN); consult your distribution for the backported kernel version. As an interim mitigation, disable nftables flowtable offloading or avoid routing bridged-VLAN traffic through flowtable paths. Check exposure with 'nft list ruleset' for flowtable definitions and review whether bridge VLAN untagging traffic is being offloaded.