Executive brief
A vulnerability in the Linux kernel's networking stack can cause systems to ignore certain network management messages. Specifically, it affects the Generic Attribute Registration Protocol (GARP), which is used for managing VLAN registrations. An attacker or a misconfigured network device could send specific network traffic that causes the system to fail to process Join or Leave events, potentially leading to network connectivity issues or incorrect VLAN configurations.
Technical details
An unsigned integer underflow exists in the `garp_pdu_parse_attr` function within `net/802/garp.c`. The parser incorrectly calculates the data length (`dlen`) using reversed operands: `sizeof(*ga) - ga->len`. Because `ga->len` (the on-wire attribute length) includes the header and is typically larger than the header structure itself, the subtraction underflows. The resulting large value is truncated when passed to `garp_attr_lookup()`, which expects a `u8`. This causes a mismatch with locally registered attributes, leading the kernel to silently drop GARP Join/Leave PDUs. This affects protocols relying on GARP, such as GVRP. The issue is fixed by correcting the operand order to `ga->len - sizeof(*ga)`.
Affected products
- Linux Linux eca9ebac651f to 16e408e607a9
Timeline
- 2026-05-27: disclosed: Vulnerability reported by Yizhou Zhao
- 2026-06-02: patched: Initial fix committed to mainline kernel
- 2026-07-19: advisory: CVE-2026-63868 published
References
- https://git.kernel.org/stable/c/04e22fefac1af3e32f245e9045382348773b5d59
- https://git.kernel.org/stable/c/16e408e607a94b646fb14a2a98422c6877ae4b3c
- https://git.kernel.org/stable/c/29f28172afb2ae7b31e9bf3e978396f20b381688
- https://git.kernel.org/stable/c/74e02121be1dcc0efcd56ebdf0171d6129105659
- https://git.kernel.org/stable/c/973cf7c433d27f4d9556d0b7c332543be7ed7a6e
- https://git.kernel.org/stable/c/a11f1a671b1361f0f1278dc0041374f2730df73f
- https://git.kernel.org/stable/c/d4c86ea09ae3e63ee5aa86e941fcc38e0e39874a