In the Linux kernel, an underflow bug in netfilter’s flowtable handling of bridge VLAN untagging can cause a u8 counter to wrap to 255 when it starts at 0. This wrap leads to an out‑of‑bounds read of the encapsulation array, potentially exposing stack data and corrupting route descriptors.

Linux kernel users across all distributions that employ the standard netfilter flowtable implementation are affected. All kernel releases prior to the commit that applies the fix are at risk; no specific version ranges are enumerated in the data.

Based on the description, it is inferred that an attacker would need to create a malicious packet or configure a bridge to produce a malformed path stack to trigger the underflow. The CVSS and EPSS metrics are not provided, and the vulnerability is not listed in the CISA KEV catalog, indicating no known public exploitation. The potential for data leakage exists if the special conditions are met, so operators should apply the patch as soon as possible.