CVE-2026-80634

A flaw was found in the Linux kernel's netfilter flowtable component. An integer underflow can occur during bridge Virtual Local Area Network (VLAN) untagging operations. If the num_encaps value is zero, a decrement operation can cause it to wrap to 255. This can lead to an out-of-bounds stack read when processing network paths, potentially resulting in information disclosure or system instability if a malformed bridge path stack is processed.

A moderate-impact flaw was found in the Linux kernel netfilter flowtable component in Red Hat Enterprise Linux 9 and 10. When a flowtable offload path traverses a bridge VLAN untag entry, the num_encaps counter (an unsigned 8-bit value) is post-decremented inside a WARN_ON_ONCE() even when it is already zero, causing it to wrap to 255. nft_dev_forward_path() then uses the wrapped count to walk the two-element info.encap[] array, resulting in an out-of-bounds stack read and a bogus encapsulation count copied into the route descriptor. This can lead to disclosure of kernel stack data or system instability such as a kernel panic, so the primary impact is denial of service. Triggering the flaw requires processing a malformed bridge path stack, which in practice requires local privileged network configuration (Red Hat CVSS 5.5, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), limiting exploitability. Red Hat Enterprise Linux 6, 7, and 8 and Red Hat In-Vehicle OS are not affected because the vulnerable code is not present in those kernels. For the affected Red Hat Enterprise Linux 9 and 10 kernels, the fix is deferred to a future scheduled update; the residual risk is considered limited because the issue only manifests with an already-malformed bridge VLAN path configuration and the practical consequence is a system crash rather than attacker-controlled execution. The CVE.org severity of Critical (9.8) does not reflect the actual attack requirements or impact; Red Hat rates this flaw Moderate because exploitation requires a privileged local configuration and the result is primarily loss of availability.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.