CVE-2026-63868 Details
Description
In the Linux kernel, the following vulnerability has been resolved: net: garp: fix unsigned integer underflow in garp_pdu_parse_attr The receive-side GARP attribute parser computes dlen with reversed operands: dlen = sizeof(*ga) - ga->len; ga->len is the on-wire attribute length and includes the GARP attribute header. For normal attributes with data, ga->len is larger than sizeof(*ga), so the subtraction underflows in unsigned arithmetic. The resulting value is later passed to garp_attr_lookup(), whose length argument is u8. After truncation, the parsed data length usually no longer matches the length stored for locally registered attributes, so received Join/Leave events are ignored. This breaks the GARP receive path for common attributes, such as GVRP VLAN registration attributes. Compute the data length as the attribute length minus the header length.
A vulnerability in the Linux kernel's GARP (Generic Attribute Registration Protocol) attribute parser has been identified, specifically in the receive-side processing of GARP attributes. The issue arises from the parser incorrectly calculating the data length by subtracting the on-wire attribute length (which includes the GARP header) from the size of the attribute structure. This miscalculation creates an unsigned integer underflow, as normal attributes with data have a length greater than the size of the structure. The underflowed value is then truncated and passed to the `garp_attr_lookup()` function, leading to a mismatch between the parsed data length and the length of locally registered attributes. As a result, GARP Join/Leave events are ignored, disrupting the GARP receive path for common attributes like GVRP VLAN registration. The vulnerability affects several versions of the Linux kernel.
The vulnerability has been fixed in the Linux kernel. Users should upgrade to the latest version of the stable Linux kernel to apply the patch.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No CVSS 3.x data is available for this CVE.
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
No weakness enumeration is available for this CVE.
Affected Products
No affected product data is available for this CVE.
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 19, 2026 | New CVE Received | kernel.org |