CVE-2026-80634

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag

The DEV_PATH_BR_VLAN_UNTAG case post-decrements info->num_encaps

inside WARN_ON_ONCE(). num_encaps is u8, so if it's already 0 the

decrement still happens and wraps it to 255. The break only leaves

the inner switch -- a later path entry can set info->indev back to

a real device, and we end up returning with num_encaps == 255.

nft_dev_forward_path() then walks info.encap[] (size 2) up to

num_encaps, which means an OOB stack read and a bogus count copied

into the route descriptor.

Should only happen on a malformed bridge path stack, hence the WARN,

but worth handling sanely. Move the decrement out of the WARN.

[ While at this, remove the WARN_ON_ONCE since this can only happen

with a buggy bridge path stack --pablo ].

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References