CVE-2026-63868

A flaw was found in the Linux kernel's Generic Attribute Registration Protocol (GARP) network component. A remote attacker could send specially crafted GARP attributes, leading to an unsigned integer underflow during attribute parsing. This underflow causes the system to incorrectly process attribute lengths, resulting in legitimate GARP Join/Leave events being ignored. The primary impact is a denial of service, disrupting network functionalities that rely on GARP, such as GVRP VLAN registration.

This vulnerability is rated as Moderate impact for Red Hat Enterprise Linux because the Generic Attribute Registration Protocol (GARP) is not configured or loaded by default in standard deployments. Exploitation requires the target system to actively run GARP-dependent protocols, such as GVRP on dynamic VLAN links. Even under attack, the resulting integer underflow drops incoming registration and deregistration events without compromising system integrity or inducing kernel crashes, limiting the blast radius to a denial of dynamic network configuration updates.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.