CRITICAL Introduced in 5.13
netfilter BridgeVlan OOB
CVE-2026-80634
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.3HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag The DEV_PATH_BR_VLAN_UNTAG case post-decrements info->num_encaps inside WARN_ON_ONCE(). num_encaps is u8, so if it's already 0 the decrement still happens and wraps it to 255. The break only leaves the inner switch -- a later path entry can set info->indev back to a real device, and we end up returning with num_encaps == 255. nft_dev_forward_path() then walks info.encap[] (size 2) up to num_encaps, which means an OOB stack read and a bogus count copied into the route descriptor. Should only happen on a malformed bridge path stack, hence the WARN, but worth handling sanely. Move the decrement out of the WARN. [ While at this, remove the WARN_ON_ONCE since this can only happen with a buggy bridge path stack --pablo ].
02KernelScan AI Analysis
Risk summary
A local attacker who can configure nftables flow offload with bridge VLAN filtering can trigger an integer underflow that causes a large out-of-bounds stack read in the kernel. This can leak kernel stack memory and potentially crash the system. The required CAP_NET_ADMIN is obtainable inside an unprivileged user namespace, making it reachable from containers or untrusted local users.
Vulnerability analysis
When the netfilter flowtable parses a bridge VLAN untag path entry, it decrements an unsigned encapsulation counter without first checking whether it is already zero. The counter wraps to 255, and a later loop uses this inflated value to walk a small fixed-size stack array, reading far beyond its bounds and copying garbage data into a route descriptor. The fix checks for zero before decrementing and exits the path early if the counter is already zero, preventing the underflow entirely. The vulnerable path is reached through nftables flow offload configuration with bridge VLAN filtering, which can be set up by a local user holding CAP_NET_ADMIN — a capability obtainable inside an unprivileged user namespace.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 7.1 | 5.13 | 7.1.5 | 2f55fa28011c |
| mainline | 5.13 | 7.2 | e052f920773b |