---
id: CVE-2026-80634
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag

  The DEV_PATH_BR_VLAN_UNTAG case post-decrements info->num_encaps
  inside WARN_ON_ONCE()
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag

  The DEV_PATH_BR_VLAN_UNTAG case post-decrements info->num_encaps
  inside WARN_ON_ONCE(). num_encap…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= e990cef6516daa4e1e236433579e333f74fd38cb <
    547ea9f567498e4accc89e7816264f15a1a0629f
  - >-
    Linux >= e990cef6516daa4e1e236433579e333f74fd38cb <
    2f55fa28011c97d6495d5787808db10a8c2d690d
  - >-
    Linux >= e990cef6516daa4e1e236433579e333f74fd38cb <
    e052f920773b73be49eb4d8702a9f85de7464363
  - Linux 5.13
published: '2026-08-28'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T11:17:51.310'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-80634'
references:
  - url: 'https://git.kernel.org/stable/c/2f55fa28011c97d6495d5787808db10a8c2d690d'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/547ea9f567498e4accc89e7816264f15a1a0629f'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/e052f920773b73be49eb4d8702a9f85de7464363'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/1b52aeb40c9f04bf50eeb4ea09142139d163e239'
  - url: 'https://git.kernel.org/stable/c/ee8440bb000fff4ef8acbfc99652851e9ca0a35b'
tags:
  - nvd
  - cve.org
epss: 0.00671
epssPercentile: 0.5183
ingestedAt: '2026-08-30T03:46:31.052Z'
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-10-16T19:19:08.898847Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag

The DEV_PATH_BR_VLAN_UNTAG case post-decrements info->num_encaps
inside WARN_ON_ONCE(). num_encaps is u8, so if it's already 0 the
decrement still happens and wraps it to 255. The break only leaves
the inner switch -- a later path entry can set info->indev back to
a real device, and we end up returning with num_encaps == 255.

nft_dev_forward_path() then walks info.encap[] (size 2) up to
num_encaps, which means an OOB stack read and a bogus count copied
into the route descriptor.

Should only happen on a malformed bridge path stack, hence the WARN,
but worth handling sanely. Move the decrement out of the WARN.

[ While at this, remove the WARN_ON_ONCE since this can only happen
  with a buggy bridge path stack --pablo ].

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.