CVE-2026-80634

A moderate-impact flaw was found in the Linux kernel netfilter flowtable component in Red Hat Enterprise Linux 9 and 10. When a flowtable offload path traverses a bridge VLAN untag entry, the num_encaps counter (an unsigned 8-bit value) is post-decremented inside a WARN_ON_ONCE() even when it is already zero, causing it to wrap to 255. nft_dev_forward_path() then uses the wrapped count to walk the two-element info.encap[] array, resulting in an out-of-bounds stack read and a bogus encapsulation count copied into the route descriptor. This can lead to disclosure of kernel stack data or system instability such as a kernel panic, so the primary impact is denial of service. Triggering the flaw requires processing a malformed bridge path stack, which in practice requires local privileged network configuration (Red Hat CVSS 5.5, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), limiting exploitability. Red Hat Enterprise Linux 6, 7, and 8 and Red Hat In-Vehicle OS are not affected because the vulnerable code is not present in those kernels. For the affected Red Hat Enterprise Linux 9 and 10 kernels, the fix is deferred to a future scheduled update; the residual risk is considered limited because the issue only manifests with an already-malformed bridge VLAN path configuration and the practical consequence is a system crash rather than attacker-controlled execution. The CVE.org severity of Critical (9.8) does not reflect the actual attack requirements or impact; Red Hat rates this flaw Moderate because exploitation requires a privileged local configuration and the result is primarily loss of availability.