CVE-2026-74704net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter The sch_cake ACK filter parses packets to find the TCP header and filter duplicated ACKs if the flow is backlogged. The parsing code contains a WARN_ON(1) which can be triggered by a malformed IP header in certain cases. Depending on the system configuration, this leads either to either spamming dmesg with warnings, or a panic if panic_on_warn is set. The code already correctly skips the offending packet in the branch that triggers the warning, so the WARN_ON itself doesn't really serve any purpose. So just drop it altogether to avoid the inconvenient side effects.
- CVSS
- 8.2 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 8b7138814f29933898ecd31dfc83e35a30ee69f5 before c1693b7844a6c06d31a565e5a494948034dfd235; from 8b7138814f29933898ecd31dfc83e35a30ee69f5 before a4b52612004a5639c4bfc30ba93ba414b8326e2a; from 8b7138814f29933898ecd31dfc83e35a30ee69f5 before ae1b2f8e21a41e7c7e75511bea0c4ccc59ec1bd3; 8b7138814f29933898ecd31dfc83e35a30ee69f5 builds before 0c4882bff34558d8d53fb04c3e96da5c327c7dc8; from 8b7138814f29933898ecd31dfc83e35a30ee69f5 before 2504a76e5c0694e14e15562730e1339f2d9f9458; from 8b7138814f29933898ecd31dfc83e35a30ee69f5 before cd2f1d9fe8a507c2dc86ad326fe221f121c47734; from 8b7138814f29933898ecd31dfc83e35a30ee69f5 before a1ae353d8355407c1bea971d1c1af5e7f242bb7d; 8b7138814f29933898ecd31dfc83e35a30ee69f5 builds before 2a33516f9ef59ad11844d4fc152f889449b5daf3 | CNA record |
References
- https://git.kernel.org/stable/c/c1693b7844a6c06d31a565e5a494948034dfd235
- https://git.kernel.org/stable/c/a4b52612004a5639c4bfc30ba93ba414b8326e2a
- https://git.kernel.org/stable/c/ae1b2f8e21a41e7c7e75511bea0c4ccc59ec1bd3
- https://git.kernel.org/stable/c/0c4882bff34558d8d53fb04c3e96da5c327c7dc8
- https://git.kernel.org/stable/c/2504a76e5c0694e14e15562730e1339f2d9f9458
- https://git.kernel.org/stable/c/cd2f1d9fe8a507c2dc86ad326fe221f121c47734
- https://git.kernel.org/stable/c/a1ae353d8355407c1bea971d1c1af5e7f242bb7d
- https://git.kernel.org/stable/c/2a33516f9ef59ad11844d4fc152f889449b5daf3
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.