CVE-2026-25804 is an arithmetic overflow in Antrea, the Kubernetes networking project, rated 9.1. With many Antrea network policies at varied priorities, the priority calculation can wrap around and enforce rules in the wrong order. Versions before 2.3.2 and 2.4.3 are affected.
What's affected
- Product: Antrea, a Kubernetes native networking solution.
- Affected: versions before 2.3.2, and 2.4.0 up to before 2.4.3.
- Fixed: 2.3.2 and 2.4.3.
- Not affected: clusters that use only upstream Kubernetes NetworkPolicies and no Antrea NetworkPolicies, according to the advisory.
- Exposure: clusters with a large number of Antrea policies (ANP or ACNP) with varied priorities.
How to check if you're exposed
Find out which Antrea version runs in the cluster and whether you use Antrea policies:
kubectl -n kube-system get pods -l app=antrea -o jsonpath='{.items[*].spec.containers[*].image}'
kubectl get acnp,anp -A | wc -l
If the version is in range and the second command shows many policies, plan the upgrade quickly. If you only use standard NetworkPolicy objects, the advisory says you are not affected.
What to do now
- Upgrade Antrea to 2.3.2 or 2.4.3, depending on your minor version.
- Inventory your Antrea policies and note which depend on priority ordering between tiers.
- Test critical deny rules after upgrading, with a connection that must fail.
- Restrict who can create Antrea policies and in which tiers until the cluster is patched.
- Keep a second layer of control for sensitive services, such as application level authentication.
Why it matters
The class is a numeric overflow, with the record listing CWE-287 and CWE-770. A 16 bit counter used to turn many priorities into OpenFlow priorities wraps past its limit, so a rule meant to rank high can rank low.
The advisory spells out two outcomes: traffic that should be denied may be allowed, and traffic that should be allowed may be denied. It also notes that users limited to a lower tier could override rules in a higher tier. That makes it a policy integrity bug rather than a crash. The record does not mark it as exploited in the wild.
How to prioritise the fix
Antrea policy bugs are dangerous because nothing visibly breaks. Begin by counting Antrea policies in each cluster and noting tiers and priorities. A cluster with a handful of policies is less likely to hit the overflow than one with hundreds across tiers.
After upgrading, test the rules that matter most. Pick a few deny rules that protect sensitive services and try a connection that must fail from a pod that should not reach them. Do the same for key allow rules, since the advisory says both wrong allows and wrong denies can happen.
Quick check
Is my cluster affected if I use plain Kubernetes NetworkPolicy?
The advisory says deployments that only use upstream Kubernetes NetworkPolicies are not affected.
What is the hardest part to notice?
Nothing errors. Policies load fine while enforcing the wrong order, so test deny rules directly.
Sources
Last reviewed: 19 October 2026.
