Skip to main content

Linux Kernel EUVDEUVD-2026-67510

| CVE-2026-80634 CRITICAL
2026-08-28 Linux GHSA-jm3q-xwgv-hgh8
Information Disclosure Linux
Critical
Disputed · 9.8 Vendor: Linux
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Gain CAP_NET_ADMIN on host
  2. Delivery
    Configure malformed bridge VLAN path with flowtable offload
  3. Exploit
    Trigger DEV_PATH_BR_VLAN_UNTAG num_encaps underflow to 255
  4. Execution
    Kernel walks encap[] out of bounds
  5. Impact
    Leak adjacent kernel stack memory

Vulnerability Assessment

Exploitation Conditions

Exploitation requires the netfilter flowtable offload code to process a malformed/buggy bridge path stack that hits the DEV_PATH_BR_VLAN_UNTAG case while info->num_encaps is already 0, followed by a later path entry that restores info->indev to a real device. Concretely this needs: (1) a kernel from ~5.13 with flowtable offload in use, (2) traffic offloaded across a bridge with VLAN untagging, and (3) a bridge/VLAN path topology crafted or corrupted enough to reach the underflow - which in turn needs CAP_NET_ADMIN-level control to set up bridge and flowtable configuration. Limiting factors: the code path is not exercised by default configurations (no flowtable-over-bridge = not vulnerable), the WARN comment states it 'should only happen' with a buggy bridge path stack, and the concrete impact is a bounded out-of-bounds stack read rather than controllable memory corruption.
Impact

The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8) is inconsistent with the description and should be treated with skepticism. The description explicitly states the condition 'should only happen on a malformed bridge path stack,' which is not a remote, unauthenticated, default-configuration scenario - constructing a malformed bridge/VLAN path stack requires CAP_NET_ADMIN-level control over bridge and flowtable configuration, i.e. local privileged access, not a network packet. The realistic impact is an out-of-bounds stack read (information disclosure, matching the 'Information Disclosure' tag) plus a corrupted route descriptor, not full C/I/A compromise. Corroborating this, EPSS is only 0.15% (5th percentile) and the CVE is absent from CISA KEV, so there is no evidence of widespread or targeted exploitation. Bottom line: this is a defense-in-depth kernel hardening fix rather than an emergency 9.8 - the network-vector, unauthenticated framing appears to be an over-scored automated rating and should be verified against the actual configuration prerequisites before prioritizing it as critical.
Exploit ScenarioDerived

A local user or container with network-administration capability configures a deliberately malformed bridge VLAN path stack and installs a flowtable offload rule that traverses it, causing the DEV_PATH_BR_VLAN_UNTAG underflow. The kernel then reads out-of-bounds stack memory into the route descriptor, potentially leaking adjacent kernel stack contents. No public proof-of-concept is identified at time of analysis, and the malformed-path prerequisite makes opportunistic exploitation unlikely.
Act Now Prioritize within 24-48h. Why: CRITICAL severity.
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Aug 29, 2026

Out-of-bounds stack read in the Linux kernel's netfilter flowtable (nf_flow_table / nft_dev_forward_path) affects the bridge VLAN-untag fast path, where a u8 num_encaps counter can underflow from 0 to 255 and cause the kernel to walk a fixed 2-entry encap[] array far past its bounds. Affected are kernels from 5.13 onward that use netfilter flowtable offload over bridge devices; the flaw leaks adjacent kernel stack memory into a route descriptor and copies a bogus encap count. No public exploit is identified at time of analysis, EPSS is low (0.15%), and it is not in CISA KEV.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - apply the stable-tree commits at https://git.kernel.org/stable/c/e052f920773b73be49eb4d8702a9f85de7464363 and https://git.kernel.org/stable/c/2f55fa28011c97d6495d5787808db10a8c2d690d, which move the num_encaps decrement out of WARN_ON_ONCE() and drop the WARN. In practice, update to the distribution kernel that incorporates these commits (track your vendor's advisory referencing CVE-2026-80634 / EUVD-2026-67510). As a compensating control until patched, avoid enabling netfilter flowtable hardware/software offload over bridge devices (do not add flowtable offload rules bound to bridge ports), since the vulnerable path is only reached through bridge VLAN-untag flow offload; the trade-off is loss of the connection-tracking fast-path performance benefit for bridged traffic. Restricting CAP_NET_ADMIN and preventing untrusted users from configuring bridge/VLAN topologies further reduces the ability to construct the malformed path stack.

Affected VersionsENISA

Linux 5.13
Linux e990cef6516daa4e1e236433579e333f74fd38cb <e052f920773b73be49eb4d8702a9f85de7464363
Linux patch: 0
Linux e990cef6516daa4e1e236433579e333f74fd38cb <2f55fa28011c97d6495d5787808db10a8c2d690d
Linux patch: 7.1.5
Linux patch: 7.2

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The vulnerability lives in the netfilter software/hardware flow-offload path (nf_flow_table_offload), specifically device-path resolution across a bridge with VLAN tagging. When the kernel resolves the forwarding path it records encapsulation layers in info->encap[] (a 2-element array) and a u8 counter info->num_encaps. In the DEV_PATH_BR_VLAN_UNTAG case the counter was post-decremented inside a WARN_ON_ONCE(); because the decrement executes regardless of the warning's condition, decrementing 0 wraps the u8 to 255. A subsequent path entry can reset info->indev to a real device, so the function returns with num_encaps == 255. nft_dev_forward_path() then iterates encap[] up to num_encaps, reading well beyond the 2-slot array - an out-of-bounds stack read. The root cause is an unsigned integer underflow (CWE-191-class, listed as N/A in the input) combined with an out-of-bounds read (CWE-125-class); the CWE field was not populated in the source data.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Medium–Critical)
Vendor (Linux) PRIMARY 9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 3.0 LOW

Requires local CAP_NET_ADMIN control to build a malformed bridge/flowtable path (AV:L, PR:H), the malformed-stack precondition makes it AC:H, and impact is a bounded OOB stack read (C:L, A:L).

3.1 AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:L
4.0 AV:L/AC:H/AT:N/PR:H/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE 6.3 HIGH
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H
Red Hat 5.5 MEDIUM

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
CVSS changed
Aug 29, 2026 - 07:22 NVD
9.8 (CRITICAL)
Patch available
Aug 28, 2026 - 09:02 EUVD
CVE Published
Aug 28, 2026 - 06:48 cve.org
CRITICAL 9.8
CVE Published
Aug 28, 2026 - 06:48 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag

The DEV_PATH_BR_VLAN_UNTAG case post-decrements info->num_encaps inside WARN_ON_ONCE(). num_encaps is u8, so if it's already 0 the decrement still happens and wraps it to 255. The break only leaves the inner switch -- a later path entry can set info->indev back to a real device, and we end up returning with num_encaps == 255.

nft_dev_forward_path() then walks info.encap[] (size 2) up to num_encaps, which means an OOB stack read and a bogus count copied into the route descriptor.

Should only happen on a malformed bridge path stack, hence the WARN, but worth handling sanely. Move the decrement out of the WARN.

[ While at this, remove the WARN_ON_ONCE since this can only happen with a buggy bridge path stack --pablo ].

Executive ViewAI

Why It Matters

Linux kernel versions 5.13 and later contain a CRITICAL stack memory leak in the netfilter flowtable module affecting bridge VLAN processing, exposing kernel memory contents to attackers. Organizations operating Linux-based firewalls, network appliances, load balancers, and cloud infrastructure must prioritize patching to prevent information disclosure and system instability.

Business Impact: High
Compensating Controls

Apply vendor patch. Interim mitigation: disable netfilter flowtable hardware offload on affected bridge interfaces using ethtool --offload [interface] hw-tc-offload off to prevent the out-of-bounds read; this eliminates exploitability but reduces network forwarding performance until patching can be completed.

Threat Intelligence Overview

EPSS Score
0.2%
Top 95% exploitable
Prevalence
Ubiquitous
Linux kernel runs everywhere, though the vulnerable flowtable-bridge path is narrow
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity CRITICAL
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
CRITICAL severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact
High

Priority Score

49
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +49
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-80634 ADVISORY https://ubuntu.com/security/notices/USN-8887-1 ADVISORY https://ubuntu.com/security/notices/USN-8888-1 ADVISORY https://ubuntu.com/security/notices/USN-8889-1 ADVISORY https://vuldb.com/vuln/396574 REF https://git.kernel.org/stable/c/1b52aeb40c9f04bf50eeb4ea09142139d163e239 REF https://git.kernel.org/stable/c/2f55fa28011c97d6495d5787808db10a8c2d690d REF https://git.kernel.org/stable/c/547ea9f567498e4accc89e7816264f15a1a0629f REF https://git.kernel.org/stable/c/9a4e3a9017ba3da2de187b72ed6545641a0d0a84 REF https://git.kernel.org/stable/c/e052f920773b73be49eb4d8702a9f85de7464363 REF https://git.kernel.org/stable/c/ee8440bb000fff4ef8acbfc99652851e9ca0a35b

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy