---
id: CVE-2026-80634
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag

  The DEV_PATH_BR_VLAN_UNTAG case post-decrements info->num_encaps
  inside WARN_ON_ONCE()
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag

  The DEV_PATH_BR_VLAN_UNTAG case post-decrements info->num_encaps
  inside WARN_ON_ONCE(). num_encap…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
published: '2026-08-28'
updated: '2026-08-29'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-80634'
references:
  - url: 'https://git.kernel.org/stable/c/2f55fa28011c97d6495d5787808db10a8c2d690d'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/e052f920773b73be49eb4d8702a9f85de7464363'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
epss: 0.00553
epssPercentile: 0.43859
ingestedAt: '2026-08-30T03:46:31.052Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag

The DEV_PATH_BR_VLAN_UNTAG case post-decrements info->num_encaps
inside WARN_ON_ONCE(). num_encaps is u8, so if it's already 0 the
decrement still happens and wraps it to 255. The break only leaves
the inner switch -- a later path entry can set info->indev back to
a real device, and we end up returning with num_encaps == 255.

nft_dev_forward_path() then walks info.encap[] (size 2) up to
num_encaps, which means an OOB stack read and a bogus count copied
into the route descriptor.

Should only happen on a malformed bridge path stack, hence the WARN,
but worth handling sanely. Move the decrement out of the WARN.

[ While at this, remove the WARN_ON_ONCE since this can only happen
  with a buggy bridge path stack --pablo ].

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.