External risk intelligence

Linux Kernel Netfilter Flowtable Stack Overflow

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-80634

This Linux kernel netfilter vulnerability requires specific, malformed bridge VLAN configurations to trigger. It is not a public-facing service. While technically reachable via network input, the complexity of the required bridge path state makes exploitation via remote, untrusted traffic highly improbable in standard production environments.

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability in the Linux kernel's netfilter component could allow for unauthorized access to system memory if a specific, malformed bridge VLAN configuration is present. While the issue has been addressed, confirming its relevance to your environment is the primary concern.

A complex configuration issue in Linux networking.
Matters for network infrastructure with specific bridge setups.
Confirm relevance and exposure for this kernel component.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted network traffic through a Linux bridge configured with VLANs. This malformed traffic could lead to an integer underflow in the netfilter component, specifically affecting how flow tables handle VLAN untagging. If successful, this could result in an out-of-bounds read on the stack, potentially allowing an attacker to influence data processed by the system.

Requires malformed bridge VLAN traffic.
Triggers an underflow in netfilter.
Risk of out-of-bounds stack read.

Live Threat

Current exploitation, exposure, and threat context

This Linux kernel vulnerability could impact system integrity when processing malformed bridge VLAN traffic. An out-of-bounds read on the stack may occur, potentially leading to the disclosure of sensitive information or a denial of service.

System stack data at risk.
Malformed bridge VLAN traffic triggers.
Information disclosure or denial of service.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Linux kernel vulnerability in netfilter's flowtable component could impact systems utilizing bridge VLAN configurations. Infrastructure or platform teams managing the Linux kernel are likely responsible for addressing this issue. The first practical step involves identifying affected systems, assessing their exposure, and coordinating remediation efforts, potentially involving vendor coordination if custom kernel modules are in use.

Infrastructure/Platform teams own the fix.
Verify bridge VLAN configurations and network reachability.
Plan kernel updates during scheduled maintenance.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Linux kernel netfilter component?

Netfilter is a powerful subsystem within the Linux kernel that provides a framework for packet filtering, network address translation, and other packet manipulations. It serves as the foundation for the system's firewall and traffic routing capabilities, handling the flow of data as it moves through the networking stack.

What does CVE-2026-80634 mean for system memory?

This vulnerability is an integer underflow flaw. Specifically, when the system incorrectly calculates the number of VLAN tags, an internal counter can wrap around to an extremely high number. This can cause the software to read memory outside of its intended boundaries, known as an out-of-bounds read, potentially exposing stack data.

How is this netfilter vulnerability triggered?

The issue is triggered when the kernel processes specially crafted, malformed network traffic specifically directed at a Linux bridge configured with VLANs. Standard, well-formed network traffic or systems not utilizing bridge VLAN encapsulation do not trigger this error, as the fault relies on a specific sequence of malformed bridge path states.

Is my system at risk according to Halo Surface Signal?

Halo Surface Signal labels this as Unlikely. While the vulnerability exists in the network stack, it is not a direct, public-facing service bug. The requirement for a highly specific, malformed bridge VLAN configuration makes successful exploitation via remote, untrusted traffic extremely improbable in standard, properly functioning network environments.

What should I do if I run Linux infrastructure?

Your first step is to identify systems that utilize bridge VLAN configurations. Consult with your platform or infrastructure team to assess if your kernel version requires an update. Because this involves core networking code, coordinate with your distribution vendor to apply the necessary patches during your next scheduled maintenance window.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.