CVE-2026-72326net/sched: cake: reject overhead values that underflow length
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: net/sched: cake: reject overhead values that underflow length CAKE accepts signed overhead values and stores them in an s16, but the adjusted packet length calculation uses unsigned arithmetic. A negative effective length can therefore wrap to a large value. Such configurations make rate accounting depend on integer wraparound rather than on the packet size userspace intended to model. A static netlink lower bound is not enough because packets reaching CAKE can be smaller than any reasonable manual-overhead allowance. Fold the signed overhead adjustment into the existing datapath MPU clamp so negative adjusted lengths are clamped before link-layer framing adjustments.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Aug 17, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from a729b7f0bd5bf4919306556aed614438f5174537 before f511dd7bf6077aa7afbe72914520553fedaacbb4; from a729b7f0bd5bf4919306556aed614438f5174537 before e1df6cff03aad8c96e55a8b2a991e505c7a3ff6f; from a729b7f0bd5bf4919306556aed614438f5174537 before 297f459865360b46a887667cbf3aac6a6f013841; from a729b7f0bd5bf4919306556aed614438f5174537 before 336c1e414fc0e9844d445174e8ada2a7dd8d1c4b; from a729b7f0bd5bf4919306556aed614438f5174537 before bcdf3a3664f7d2c4e37e155f30f72ef33f041804; from a729b7f0bd5bf4919306556aed614438f5174537 before 7aa0e64fea778a9e3df73e64da95367ff8ad2ea5; from a729b7f0bd5bf4919306556aed614438f5174537 before f1e7807df5bf2d42a40266430e9f82f37633cdcf; from a729b7f0bd5bf4919306556aed614438f5174537 before b7f97cae7ec1b6c3c32843c42be218690d310467 | CNA record |
References
- https://git.kernel.org/stable/c/f511dd7bf6077aa7afbe72914520553fedaacbb4
- https://git.kernel.org/stable/c/e1df6cff03aad8c96e55a8b2a991e505c7a3ff6f
- https://git.kernel.org/stable/c/297f459865360b46a887667cbf3aac6a6f013841
- https://git.kernel.org/stable/c/336c1e414fc0e9844d445174e8ada2a7dd8d1c4b
- https://git.kernel.org/stable/c/bcdf3a3664f7d2c4e37e155f30f72ef33f041804
- https://git.kernel.org/stable/c/7aa0e64fea778a9e3df73e64da95367ff8ad2ea5
- https://git.kernel.org/stable/c/f1e7807df5bf2d42a40266430e9f82f37633cdcf
- https://git.kernel.org/stable/c/b7f97cae7ec1b6c3c32843c42be218690d310467
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.