CVE-2026-63868

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An unsigned integer underflow exists in the receive-side GARP attribute parser within the garp pdu parse attr() function. The issue occurs because the variable dlen is computed using reversed operands: sizeof(*ga) - ga->len. Since ga->len (the on-wire attribute length) is typically larger than the header size sizeof(*ga), the subtraction underflows. The resulting truncated value is passed to the garp attr lookup() function, causing the system to ignore received Join/Leave events. This failure disrupts the GARP receive path for common attributes, including GVRP VLAN registration attributes.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.