Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag The DEV_PATH_BR_VLAN_UNTAG case post-decrements info->num_encaps inside WARN_ON_ONCE(). num_encaps is u8, so if it's already 0 the decrement still happens and wraps it to 255. The break only leaves the inner switch -- a later path entry can set info->indev back to a real device, and we end up returning with num_encaps == 255. nft_dev_forward_path() then walks info.encap[] (size 2) up to num_encaps, which means an OOB stack read and a bogus count copied into the route descriptor. Should only happen on a malformed bridge path stack, hence the WARN, but worth handling sanely. Move the decrement out of the WARN. [ While at this, remove the WARN_ON_ONCE since this can only happen with a buggy bridge path stack --pablo ].

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-28T08:16:48.303Z",
  "pubdate": "2026-08-28T08:16:48.303Z",
  "executiveSummary": "A critical integer underflow vulnerability has been identified in the Linux kernel's netfilter flowtable implementation, specifically within the bridge VLAN handling logic.\nThe vulnerability occurs in the DEV_PATH_BR_VLAN_UNTAG case, where an unsigned 8-bit integer (num_encaps) is incorrectly decremented without validation, leading to an underflow to 255.\nThis flaw allows for an out-of-bounds (OOB) memory access during the subsequent processing by nft_dev_forward_path(), as the function relies on the corrupted count to iterate through the encap[] array.\nImpact includes potential memory corruption, unauthorized information disclosure, or system instability via kernel panic if the OOB read attempts to access restricted memory regions.\nThe vulnerability is triggered when a malformed bridge path stack is processed, requiring an attacker to have the ability to influence or craft specific network bridge configurations or packets that reach the vulnerable flowtable logic.\nWhile the original code included a WARN_ON_ONCE check, the improper placement of the decrement operation effectively bypassed protective logic, necessitating a structural code change to ensure integer safety.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper handling of the num_encaps field within the flowtable path descriptor. During the processing of the DEV_PATH_BR_VLAN_UNTAG case, the kernel logic performs a post-decrement operation on info->num_encaps inside a WARN_ON_ONCE macro. Because num_encaps is typed as an unsigned 8-bit integer (u8), a value of zero is decremented to 255 due to integer wrap-around.\nFollowing this decrement, the current execution flow performs a break from the inner switch statement, but not from the parent control loop. If a subsequent path entry re-assigns info->indev to a legitimate device, the function returns with the corrupted num_encaps value (255) still intact.\nThe primary exploitation vector involves nft_dev_forward_path(), which uses this corrupted num_encaps value to bound the iteration of the info->encap[] array. As the array is defined with a fixed size of 2, the function attempts to read indices far beyond the allocated stack memory. This results in an out-of-bounds (OOB) memory read.\nAn attacker capable of influencing the bridge network topology can force the kernel into this malformed state. By supplying crafted packets or inducing specific bridge VLAN configurations, the attacker can cause the kernel to copy bogus counts into the route descriptor. This leads to the leakage of stack memory contents, which may contain sensitive kernel pointers or data, or cause a kernel crash resulting from an invalid memory access.\nThe vulnerability represents a flaw in input validation and state management within the netfilter subsystem. By incorrectly assuming the bridge stack is always well-formed, the kernel fails to perform bounds checking before the decrement, allowing a state inconsistency that propagates to other functions relying on the flowtable's integrity. The remediation involves moving the decrement operation outside of the warning macro and implementing a check to prevent the underflow entirely before the value is manipulated."
}