In the Linux kernel, the netfilter flowtable component has an integer underflow bug that occurs during bridge VLAN untag processing. When the 8‑bit counter num_encaps is decremented while already at 0, it wraps to 255. The counter is later used to index a two‑element encapsulation array, causing the kernel to read beyond the bounds exposing stack data and potentially corrupting routing descriptors via an out‑of‑bounds read (CWE‑125). This results in a stack data disclosure and may disrupt packet forwarding when the malformed path is encountered.

All Linux kernel users that employ the default netfilter flowtable implementation are affected. The issue exists in any kernel release prior to the commit that patches the underflow; specific version ranges are not listed, so assume all kernels older than the fix are at risk.

The bug is triggered only by a malformed bridge path stack, so the likely attack vector involves configuring a malicious bridge VLAN untag or crafting packets to induce the underflow. Based on the description, it is inferred that the attacker would need to manipulate bridge configurations to create the malformed path. The CVSS score of 9.8 indicates high severity, while the EPSS score is below 1% and the vulnerability is not listed in CISA’s KEV catalog, implying no known public exploitation. Operators should treat the vulnerability as high risk when the necessary conditions can be met.