CVE-2026-80634

Critical

Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag The DEV_PATH_BR_VLAN_UNTAG case post-decrements info->num_encaps inside WARN_ON_ONCE(). num_encaps is u8, so if it's already 0 the decrement still happens and wraps it to 255. The break only leaves the inner switch -- a later path entry can set info->indev back to a real device, and we end up returning with num_encaps == 255. nft_dev_forward_path() then walks info.encap[] (size 2) up to num_encaps, which means an OOB stack read and a bogus count copied into the route descriptor. Should only happen on a malformed bridge path stack, hence the WARN, but worth handling sanely. Move the decrement out of the WARN. [ While at this, remove the WARN_ON_ONCE since this can only happen with a buggy bridge path stack --pablo ].

SeverityCritical

CVSS9.8

Exploit probability—

Product

Linux

PublishedAug 28, 2026

First seenAug 28, 2026

How to fix

Update

Linux Linux9a4e3a9017ba3da2de187b72ed6545641a0d0a84, 1b52aeb40c9f04bf50eeb4ea09142139d163e239, ee8440bb000fff4ef8acbfc99652851e9ca0a35b, 547ea9f567498e4accc89e7816264f15a1a0629f, 2f55fa28011c97d6495d5787808db10a8c2d690d, e052f920773b73be49eb4d8702a9f85de7464363 or later

Affected products

Product	Affected versions	Fixed in
Linux Linux	e990cef6516daa4e1e236433579e333f74fd38cb ≤ v < 9a4e3a9017ba3da2de187b72ed6545641a0d0a84, e990cef6516daa4e1e236433579e333f74fd38cb ≤ v < 1b52aeb40c9f04bf50eeb4ea09142139d163e239, e990cef6516daa4e1e236433579e333f74fd38cb ≤ v < ee8440bb000fff4ef8acbfc99652851e9ca0a35b, e990cef6516daa4e1e236433579e333f74fd38cb ≤ v < 547ea9f567498e4accc89e7816264f15a1a0629f, e990cef6516daa4e1e236433579e333f74fd38cb ≤ v < 2f55fa28011c97d6495d5787808db10a8c2d690d, e990cef6516daa4e1e236433579e333f74fd38cb ≤ v < e052f920773b73be49eb4d8702a9f85de7464363, 5.13	9a4e3a9017ba3da2de187b72ed6545641a0d0a84, 1b52aeb40c9f04bf50eeb4ea09142139d163e239, ee8440bb000fff4ef8acbfc99652851e9ca0a35b, 547ea9f567498e4accc89e7816264f15a1a0629f, 2f55fa28011c97d6495d5787808db10a8c2d690d, e052f920773b73be49eb4d8702a9f85de7464363

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.