Linux Kernel Netfilter Incorrect Arithmetic Vulnerability in VLAN Header Processing

A vulnerability in the Linux kernel's netfilter component was introduced by improper arithmetic when handling VLAN header bits. This issue arises if the combined offset and length exceed the Ethernet and VLAN header limits. In such cases, the length is modified to copy only the bytes within the VLAN Ethernet header scratchpad area, while any excess bytes are taken directly from the skbuff data area. The vulnerability has been addressed by correcting the arithmetic operation to subtract, rather than add, the VLAN header size for double-tagged packets, ensuring the length is accurately adjusted.

Impact

Exploitation of this vulnerability could lead to incorrect processing of network packets, potentially allowing for manipulation of VLAN-tagged traffic.