CVE-2026-63868 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
net: garp: fix unsigned integer underflow in garp_pdu_parse_attr
The receive-side GARP attribute parser computes dlen with reversed operands:
dlen = sizeof(*ga) - ga->len;
ga->len is the on-wire attribute length and includes the GARP attribute header. For normal attributes with data, ga->len is larger than sizeof(*ga), so the subtraction underflows in unsigned arithmetic.
The resulting value is later passed to garp_attr_lookup(), whose length argument is u8. After truncation, the parsed data length usually no longer matches the length stored for locally registered attributes, so received Join/Leave events are ignored. This breaks the GARP receive path for common attributes, such as GVRP VLAN registration attributes.
Compute the data length as the attribute length minus the header length.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/19/2026
The vulnerability in question affects the Linux kernel's Generic Attribute Registration Protocol implementation within the networking subsystem. This issue resides specifically in the GARP attribute parsing functionality where an unsigned integer underflow occurs during the processing of received network packets. The problem manifests in the garp_pdu_parse_attr function which handles incoming GARP protocol data units containing attribute information. When processing these attributes, the kernel computes the data length using reversed operands that result in arithmetic underflow conditions typical of unsigned integer operations.
The technical flaw stems from improper calculation of the data length field where the code performs dlen = sizeof(ga) - ga->len instead of the correct computation of ga->len - sizeof(ga). Since ga->len represents the complete on-wire attribute length including the header, and sizeof(*ga) represents only the header size, reversing these operands creates a scenario where unsigned arithmetic underflow occurs when the header length exceeds the attribute length value. This mathematical error fundamentally breaks the attribute parsing logic for standard GARP operations.
The operational impact of this vulnerability is significant as it completely disables the reception path for common GARP attributes including those used in GVRP VLAN registration protocols. When the underflow occurs, the resulting truncated value passed to garp_attr_lookup() function becomes invalid due to u8 parameter type limitations, causing received Join/Leave events to be silently ignored by the system. This disruption affects network functionality where dynamic VLAN registration and attribute management rely on proper GARP protocol handling, potentially leading to network connectivity issues and failed attribute synchronization between network devices.
The vulnerability demonstrates characteristics consistent with CWE-191 Integer Underflow (Wrap or Wraparound) which falls under the broader category of integer arithmetic errors in kernel space code. From an ATT&CK perspective, this represents a privilege escalation vector through protocol manipulation that could be exploited by attackers to disrupt network communications and potentially gain deeper system access. The fix requires correcting the arithmetic calculation to properly compute attribute data length as ga->len - sizeof(*ga) ensuring that the header size is correctly subtracted from the total attribute length rather than vice versa.
This vulnerability impacts the core networking stack functionality of Linux systems where GARP protocol processing is enabled, particularly affecting network switches, routers, and devices implementing VLAN management through GVRP protocols. The remediation involves a straightforward code correction that ensures proper unsigned integer arithmetic handling in the attribute parsing routine while maintaining compatibility with existing network protocols and standards. Organizations should prioritize patching this vulnerability as it represents a fundamental breakdown in network protocol processing that could be leveraged to disrupt critical network operations and communication flows within enterprise and data center environments.