CVE-2026-80634

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the netfilter flowtable component where a post-decrement of the num encaps variable occurs within the DEV PATH BR VLAN UNTAG case. Because num encaps is an unsigned 8-bit integer (u8), if the value is 0, the decrement causes an underflow, wrapping the value to 255. Subsequently, the nft dev forward path() function iterates through the info.encap[] array (which has a size of 2) up to the value of num encaps, leading to an out-of-bounds (OOB) stack read and the copying of an incorrect count into the route descriptor. This condition typically occurs when processing a malformed bridge path stack.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.