Linux Kernel Netfilter Flowtable Integer Underflow in VLAN Handling

CVE-2026-80634 is a critical integer underflow vulnerability in the Linux kernel's netfilter flowtable subsystem, specifically in VLAN bridge untag processing. When the DEV_PATH_BR_VLAN_UNTAG case post-decrements the num_encaps field (a u8 value) within a WARN_ON_ONCE() macro, an underflow occurs if num_encaps is already 0, wrapping the value to 255. This wrapped value persists because the break statement only exits the inner switch construct, allowing subsequent path entries to manipulate indev and return with a corrupted num_encaps value. This affects any Linux system running vulnerable kernel versions with netfilter flowtable enabled, particularly those using bridge VLAN configurations, and could be exploited to cause memory corruption, denial of service, or potential privilege escalation through packet forwarding manipulation.

While CVE-2026-80634 lacks explicit MITRE ATT&CK mappings, Casky's extended reasoning capabilities would identify attack patterns consistent with network manipulation and privilege escalation techniques. Practitioners using Casky would detect suspicious patterns related to Defense Evasion (T1548 - Abuse Elevation Control Mechanism) through kernel-level packet filtering bypass, Exfiltration Over Alternative Protocol (T1048) via malformed VLAN frames traversing flowtable rules, and Denial of Service techniques (T1499) through crafted packets triggering memory corruption. The platform would flag integer arithmetic anomalies in network stack processing, bridging configuration changes paired with packet forwarding anomalies, and kernel log patterns showing repeated WARN_ON_ONCE triggers—allowing security teams to correlate system behavior with exploitation attempts before full compromise.