CVE-2026-63868

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-63868", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-19T07:54:57.017Z", "datePublished": "2026-07-19T14:18:37.823Z", "dateUpdated": "2026-11-06T16:34:24.757Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-07-19T14:18:37.823Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: garp: fix unsigned integer underflow in garp_pdu_parse_attr\n\nThe receive-side GARP attribute parser computes dlen with reversed\noperands:\n\n dlen = sizeof(*ga) - ga->len;\n\nga->len is the on-wire attribute length and includes the GARP attribute\nheader. For normal attributes with data, ga->len is larger than\nsizeof(*ga), so the subtraction underflows in unsigned arithmetic.\n\nThe resulting value is later passed to garp_attr_lookup(), whose length\nargument is u8. After truncation, the parsed data length usually no\nlonger matches the length stored for locally registered attributes, so\nreceived Join/Leave events are ignored. This breaks the GARP receive path\nfor common attributes, such as GVRP VLAN registration attributes.\n\nCompute the data length as the attribute length minus the header length."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/802/garp.c"], "versions": [{"version": "eca9ebac651f774d8b10fce7c5d173c3c3d3394f", "lessThan": "29f28172afb2ae7b31e9bf3e978396f20b381688", "status": "affected", "versionType": "git"}, {"version": "eca9ebac651f774d8b10fce7c5d173c3c3d3394f", "lessThan": "973cf7c433d27f4d9556d0b7c332543be7ed7a6e", "status": "affected", "versionType": "git"}, {"version": "eca9ebac651f774d8b10fce7c5d173c3c3d3394f", "lessThan": "d8dcd14aa886b8effd83022c550669f4f262854b", "status": "affected", "versionType": "git"}, {"version": "eca9ebac651f774d8b10fce7c5d173c3c3d3394f", "lessThan": "74e02121be1dcc0efcd56ebdf0171d6129105659", "status": "affected", "versionType": "git"}, {"version": "eca9ebac651f774d8b10fce7c5d173c3c3d3394f", "lessThan": "d4c86ea09ae3e63ee5aa86e941fcc38e0e39874a", "status": "affected", "versionType": "git"}, {"version": "eca9ebac651f774d8b10fce7c5d173c3c3d3394f", "lessThan": "04e22fefac1af3e32f245e9045382348773b5d59", "status": "affected", "versionType": "git"}, {"version": "eca9ebac651f774d8b10fce7c5d173c3c3d3394f", "lessThan": "a11f1a671b1361f0f1278dc0041374f2730df73f", "status": "affected", "versionType": "git"}, {"version": "eca9ebac651f774d8b10fce7c5d173c3c3d3394f", "lessThan": "16e408e607a94b646fb14a2a98422c6877ae4b3c", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/802/garp.c"], "versions": [{"version": "2.6.27", "status": "affected"}, {"version": "0", "lessThan": "2.6.27", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.259", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.210", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.176", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.143", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.94", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.36", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.13", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.27", "versionEndExcluding": "5.10.259"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.27", "versionEndExcluding": "5.15.210"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.27", "versionEndExcluding": "6.1.176"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.27", "versionEndExcluding": "6.6.143"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.27", "versionEndExcluding": "6.12.94"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.27", "versionEndExcluding": "6.18.36"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.27", "versionEndExcluding": "7.0.13"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.27", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/29f28172afb2ae7b31e9bf3e978396f20b381688"}, {"url": "https://git.kernel.org/stable/c/973cf7c433d27f4d9556d0b7c332543be7ed7a6e"}, {"url": "https://git.kernel.org/stable/c/d8dcd14aa886b8effd83022c550669f4f262854b"}, {"url": "https://git.kernel.org/stable/c/74e02121be1dcc0efcd56ebdf0171d6129105659"}, {"url": "https://git.kernel.org/stable/c/d4c86ea09ae3e63ee5aa86e941fcc38e0e39874a"}, {"url": "https://git.kernel.org/stable/c/04e22fefac1af3e32f245e9045382348773b5d59"}, {"url": "https://git.kernel.org/stable/c/a11f1a671b1361f0f1278dc0041374f2730df73f"}, {"url": "https://git.kernel.org/stable/c/16e408e607a94b646fb14a2a98422c6877ae4b3c"}], "title": "net: garp: fix unsigned integer underflow in garp_pdu_parse_attr", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-63868", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-06T16:29:13.686506Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-06T16:34:24.757Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-63868", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-06T16:29:13.686506Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-06T16:29:19.654Z"}}], "cna": {"title": "net: garp: fix unsigned integer underflow in garp_pdu_parse_attr", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "eca9ebac651f774d8b10fce7c5d173c3c3d3394f", "lessThan": "29f28172afb2ae7b31e9bf3e978396f20b381688", "versionType": "git"}, {"status": "affected", "version": "eca9ebac651f774d8b10fce7c5d173c3c3d3394f", "lessThan": "973cf7c433d27f4d9556d0b7c332543be7ed7a6e", "versionType": "git"}, {"status": "affected", "version": "eca9ebac651f774d8b10fce7c5d173c3c3d3394f", "lessThan": "d8dcd14aa886b8effd83022c550669f4f262854b", "versionType": "git"}, {"status": "affected", "version": "eca9ebac651f774d8b10fce7c5d173c3c3d3394f", "lessThan": "74e02121be1dcc0efcd56ebdf0171d6129105659", "versionType": "git"}, {"status": "affected", "version": "eca9ebac651f774d8b10fce7c5d173c3c3d3394f", "lessThan": "d4c86ea09ae3e63ee5aa86e941fcc38e0e39874a", "versionType": "git"}, {"status": "affected", "version": "eca9ebac651f774d8b10fce7c5d173c3c3d3394f", "lessThan": "04e22fefac1af3e32f245e9045382348773b5d59", "versionType": "git"}, {"status": "affected", "version": "eca9ebac651f774d8b10fce7c5d173c3c3d3394f", "lessThan": "a11f1a671b1361f0f1278dc0041374f2730df73f", "versionType": "git"}, {"status": "affected", "version": "eca9ebac651f774d8b10fce7c5d173c3c3d3394f", "lessThan": "16e408e607a94b646fb14a2a98422c6877ae4b3c", "versionType": "git"}], "programFiles": ["net/802/garp.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "2.6.27"}, {"status": "unaffected", "version": "0", "lessThan": "2.6.27", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.259", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.210", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.176", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.143", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.94", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.36", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.0.13", "versionType": "semver", "lessThanOrEqual": "7.0.*"}, {"status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/802/garp.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/29f28172afb2ae7b31e9bf3e978396f20b381688"}, {"url": "https://git.kernel.org/stable/c/973cf7c433d27f4d9556d0b7c332543be7ed7a6e"}, {"url": "https://git.kernel.org/stable/c/d8dcd14aa886b8effd83022c550669f4f262854b"}, {"url": "https://git.kernel.org/stable/c/74e02121be1dcc0efcd56ebdf0171d6129105659"}, {"url": "https://git.kernel.org/stable/c/d4c86ea09ae3e63ee5aa86e941fcc38e0e39874a"}, {"url": "https://git.kernel.org/stable/c/04e22fefac1af3e32f245e9045382348773b5d59"}, {"url": "https://git.kernel.org/stable/c/a11f1a671b1361f0f1278dc0041374f2730df73f"}, {"url": "https://git.kernel.org/stable/c/16e408e607a94b646fb14a2a98422c6877ae4b3c"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: garp: fix unsigned integer underflow in garp_pdu_parse_attr\n\nThe receive-side GARP attribute parser computes dlen with reversed\noperands:\n\n dlen = sizeof(*ga) - ga->len;\n\nga->len is the on-wire attribute length and includes the GARP attribute\nheader. For normal attributes with data, ga->len is larger than\nsizeof(*ga), so the subtraction underflows in unsigned arithmetic.\n\nThe resulting value is later passed to garp_attr_lookup(), whose length\nargument is u8. After truncation, the parsed data length usually no\nlonger matches the length stored for locally registered attributes, so\nreceived Join/Leave events are ignored. This breaks the GARP receive path\nfor common attributes, such as GVRP VLAN registration attributes.\n\nCompute the data length as the attribute length minus the header length."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.259", "versionStartIncluding": "2.6.27"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.210", "versionStartIncluding": "2.6.27"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.176", "versionStartIncluding": "2.6.27"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.143", "versionStartIncluding": "2.6.27"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.94", "versionStartIncluding": "2.6.27"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.36", "versionStartIncluding": "2.6.27"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0.13", "versionStartIncluding": "2.6.27"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1", "versionStartIncluding": "2.6.27"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-07-19T14:18:37.823Z"}}}, "cveMetadata": {"cveId": "CVE-2026-63868", "state": "PUBLISHED", "dateUpdated": "2026-11-06T16:34:24.757Z", "dateReserved": "2026-07-19T07:54:57.017Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-07-19T14:18:37.823Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/802/garp.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "29f28172afb2ae7b31e9bf3e978396f20b381688", "status": "affected", "version": "eca9ebac651f774d8b10fce7c5d173c3c3d3394f", "versionType": "git"}, {"lessThan": "973cf7c433d27f4d9556d0b7c332543be7ed7a6e", "status": "affected", "version": "eca9ebac651f774d8b10fce7c5d173c3c3d3394f", "versionType": "git"}, {"lessThan": "d8dcd14aa886b8effd83022c550669f4f262854b", "status": "affected", "version": "eca9ebac651f774d8b10fce7c5d173c3c3d3394f", "versionType": "git"}, {"lessThan": "74e02121be1dcc0efcd56ebdf0171d6129105659", "status": "affected", "version": "eca9ebac651f774d8b10fce7c5d173c3c3d3394f", "versionType": "git"}, {"lessThan": "d4c86ea09ae3e63ee5aa86e941fcc38e0e39874a", "status": "affected", "version": "eca9ebac651f774d8b10fce7c5d173c3c3d3394f", "versionType": "git"}, {"lessThan": "04e22fefac1af3e32f245e9045382348773b5d59", "status": "affected", "version": "eca9ebac651f774d8b10fce7c5d173c3c3d3394f", "versionType": "git"}, {"lessThan": "a11f1a671b1361f0f1278dc0041374f2730df73f", "status": "affected", "version": "eca9ebac651f774d8b10fce7c5d173c3c3d3394f", "versionType": "git"}, {"lessThan": "16e408e607a94b646fb14a2a98422c6877ae4b3c", "status": "affected", "version": "eca9ebac651f774d8b10fce7c5d173c3c3d3394f", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/802/garp.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.27"}, {"lessThan": "2.6.27", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.259", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.210", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.176", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.143", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.94", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.36", "versionType": "semver"}, {"lessThanOrEqual": "7.0.*", "status": "unaffected", "version": "7.0.13", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "BB94835E-BB8B-4738-B9CD-F7FF14E4A39D", "versionEndExcluding": "5.10.259", "versionStartIncluding": "2.6.27", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "5E938CDF-D1C4-43D0-98DC-9E11B6B55801", "versionEndExcluding": "5.15.210", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C4446623-5F2B-4DD8-8666-9FAAC285A757", "versionEndExcluding": "6.1.176", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "9062F1CD-CAD6-4EA2-A73F-C06D4A887B8C", "versionEndExcluding": "6.6.143", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "85421C0C-ABDE-4357-971C-67F9087DE1B9", "versionEndExcluding": "6.12.94", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "389025D2-958D-41BD-BD96-70ED1033A9F3", "versionEndExcluding": "6.18.36", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "6A64BF9F-3BCA-42FD-98CB-8F03474D2B1E", "versionEndExcluding": "7.0.13", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*", "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*", "matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*", "matchCriteriaId": "EC732D08-5F7B-46D9-B154-E60C7F4F0A97", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*", "matchCriteriaId": "E5910A9D-F60A-409A-B486-FE66BFEBA9B9", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:*", "matchCriteriaId": "81DFF19E-9CF8-49C6-8C36-1E4038622933", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc6:*:*:*:*:*:*", "matchCriteriaId": "B0E8FC71-3952-444C-83E9-718DBBBEC615", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: garp: fix unsigned integer underflow in garp_pdu_parse_attr\n\nThe receive-side GARP attribute parser computes dlen with reversed\noperands:\n\n dlen = sizeof(*ga) - ga->len;\n\nga->len is the on-wire attribute length and includes the GARP attribute\nheader. For normal attributes with data, ga->len is larger than\nsizeof(*ga), so the subtraction underflows in unsigned arithmetic.\n\nThe resulting value is later passed to garp_attr_lookup(), whose length\nargument is u8. After truncation, the parsed data length usually no\nlonger matches the length stored for locally registered attributes, so\nreceived Join/Leave events are ignored. This breaks the GARP receive path\nfor common attributes, such as GVRP VLAN registration attributes.\n\nCompute the data length as the attribute length minus the header length."}], "id": "CVE-2026-63868", "lastModified": "2026-11-06T17:18:35.150", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-63868", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-06T16:29:13.686506Z", "version": "2.0.3"}}]}, "published": "2026-07-19T15:16:53.740", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/04e22fefac1af3e32f245e9045382348773b5d59"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/16e408e607a94b646fb14a2a98422c6877ae4b3c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/29f28172afb2ae7b31e9bf3e978396f20b381688"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/74e02121be1dcc0efcd56ebdf0171d6129105659"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/973cf7c433d27f4d9556d0b7c332543be7ed7a6e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a11f1a671b1361f0f1278dc0041374f2730df73f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d4c86ea09ae3e63ee5aa86e941fcc38e0e39874a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d8dcd14aa886b8effd83022c550669f4f262854b"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-191"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: net: garp: fix unsigned integer underflow in garp_pdu_parse_attr", "id": "2502287", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502287"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-191", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnet: garp: fix unsigned integer underflow in garp_pdu_parse_attr\nThe receive-side GARP attribute parser computes dlen with reversed\noperands:\ndlen = sizeof(*ga) - ga->len;\nga->len is the on-wire attribute length and includes the GARP attribute\nheader. For normal attributes with data, ga->len is larger than\nsizeof(*ga), so the subtraction underflows in unsigned arithmetic.\nThe resulting value is later passed to garp_attr_lookup(), whose length\nargument is u8. After truncation, the parsed data length usually no\nlonger matches the length stored for locally registered attributes, so\nreceived Join/Leave events are ignored. This breaks the GARP receive path\nfor common attributes, such as GVRP VLAN registration attributes.\nCompute the data length as the attribute length minus the header length.", "A flaw was found in the Linux kernel's Generic Attribute Registration Protocol (GARP) network component. A remote attacker could send specially crafted GARP attributes, leading to an unsigned integer underflow during attribute parsing. This underflow causes the system to incorrectly process attribute lengths, resulting in legitimate GARP Join/Leave events being ignored. The primary impact is a denial of service, disrupting network functionalities that rely on GARP, such as GVRP VLAN registration."], "name": "CVE-2026-63868", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-07-19T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-63868\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-63868\nhttps://lore.kernel.org/linux-cve-announce/2026071914-CVE-2026-63868-b5b7@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[eca9ebac651f774d8b10fce7c5d173c3c3d3394f,29f28172afb2ae7b31e9bf3e978396f20b381688)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[eca9ebac651f774d8b10fce7c5d173c3c3d3394f,973cf7c433d27f4d9556d0b7c332543be7ed7a6e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[eca9ebac651f774d8b10fce7c5d173c3c3d3394f,d8dcd14aa886b8effd83022c550669f4f262854b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[eca9ebac651f774d8b10fce7c5d173c3c3d3394f,74e02121be1dcc0efcd56ebdf0171d6129105659)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[eca9ebac651f774d8b10fce7c5d173c3c3d3394f,d4c86ea09ae3e63ee5aa86e941fcc38e0e39874a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[eca9ebac651f774d8b10fce7c5d173c3c3d3394f,04e22fefac1af3e32f245e9045382348773b5d59)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[eca9ebac651f774d8b10fce7c5d173c3c3d3394f,a11f1a671b1361f0f1278dc0041374f2730df73f)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[eca9ebac651f774d8b10fce7c5d173c3c3d3394f,16e408e607a94b646fb14a2a98422c6877ae4b3c)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.6.27"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,2.6.27)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[5.10.259,5.10.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[5.15.210,5.15.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.1.176,6.1.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.6.143,6.6.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.12.94,6.12.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.18.36,6.18.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0.13,7.0.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-07-21T13:30:07.001046+00:00", "updated": "2026-08-04T18:30:12.419832+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}