CVE-2026-25804: Antrea uint16 Overflow in Network Policy Priority Assignment
CVE-2026-25804 affects Antrea, a Kubernetes networking solution, where a uint16 arithmetic overflow in network policy priority assignment can produce incorrect OpenFlow priorities when many policies with varied priority values are handled. The record states this may lead to incorrect traffic enforcement. NVD lists a CVSS 3.1 score of 9.1, the GitHub CNA lists a CVSS 4.0 score of 8, and the record says the issue is patched in version 2.4.3.
Overview
Antrea is a Kubernetes networking solution. According to the record, affected versions contain a uint16 arithmetic overflow in network policy priority assignment. When many policies with various priority values are handled, the resulting OpenFlow priorities may be calculated incorrectly. The record describes the result as potentially incorrect traffic enforcement. See the GitHub security advisory and the NVD entry.
Impact
- Policies may take effect with unintended precedence, which could allow or block traffic that the policy author did not intend. This is an inference from the description.
- NVD scores the issue with CVSS 3.1 at 9.1, with high confidentiality and availability impact and no integrity impact according to the vector in the record.
- The GitHub CNA lists a CVSS 4.0 score of 8.
- The record classifies the weakness as CWE-287 (Improper Authentication), which does not clearly match the overflow described. This mismatch is unresolved.
Affected products and versions
- Linux Foundation Antrea: versions below 2.3.2, and versions from 2.4.0 up to but not including 2.4.3.
- The record states the issue is patched in 2.4.3. The affected ranges imply that 2.3.2 is the fixed release for the 2.3 line, which is an inference.
Exploitation status
The record shows that this CVE is not listed in the CISA KEV catalog. No confirmed exploitation in the wild appears in the sources consulted. The EPSS probability is 0.0065 with a percentile of 0.49806, dated 2026-10-13 in the record.
Remediation and mitigation
- Upgrade Antrea to 2.4.3 or later on the 2.4 line, and to 2.3.2 or later on the 2.3 line, as the affected ranges indicate.
- Review the linked commit and the pull request for the vendor's technical changes.
- Until upgrades are complete, where operationally feasible, reduce the number of overlapping policies with varied priority values and validate that enforced traffic matches the intended policy.
Detection guidance
- Inventory Antrea versions across clusters and flag any deployment below the fixed versions.
- After policy changes in large clusters, compare intended outcomes with observed traffic, looking for unexpected allows or drops.
- Track network policy priority configuration through change management to spot unusual spreads of priority values.
Limitations of the available information
The record does not provide a detailed technical description of the overflow, the exact trigger threshold, or the real-world effect in production clusters. The CWE mismatch and the EPSS date remain unresolved. The record does not state how the flaw can be exploited in practice.
Frequently asked questions
Which Antrea versions are affected by CVE-2026-25804?
According to the record, versions below 2.3.2 and versions from 2.4.0 up to but not including 2.4.3 are affected.
Is there a fix for this issue?
The record states the issue is patched in version 2.4.3. Upgrading to a fixed release on your branch is the recommended step, and the vendor advisory and linked commit describe the changes.
Is this CVE known to be exploited in the wild?
The CVE is not listed in the CISA KEV catalog in the record, and no confirmed exploitation appears in the sources consulted.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.