CVE-2026-72326
In the Linux kernel, the following vulnerability has been resolved: net/sched: cake: reject overhead values that underflow length CAKE accepts signed overhead values and stores them in an s16, but the adjusted packet length calculation uses unsigned…
Does this matter?
Not yet scored. NVD analysis is pending; check back once CVSS and EPSS values are published.
Description
In the Linux kernel, the following vulnerability has been resolved: net/sched: cake: reject overhead values that underflow length CAKE accepts signed overhead values and stores them in an s16, but the adjusted packet length calculation uses unsigned arithmetic. A negative effective length can therefore wrap to a large value. Such configurations make rate accounting depend on integer wraparound rather than on the packet size userspace intended to model. A static netlink lower bound is not enough because packets reaching CAKE can be smaller than any reasonable manual-overhead allowance. Fold the signed overhead adjustment into the existing datapath MPU clamp so negative adjusted lengths are clamped before link-layer framing adjustments.
- CVSS
- Not yet scored
- EPSS
- 0.22% probability · 13th percentile
- CISA KEV
- Not listed
- Source
- 416baaa9-dc9f-4396-8d5f-8c081fb06d67
References
- https://git.kernel.org/stable/c/297f459865360b46a887667cbf3aac6a6f013841
- https://git.kernel.org/stable/c/336c1e414fc0e9844d445174e8ada2a7dd8d1c4b
- https://git.kernel.org/stable/c/7aa0e64fea778a9e3df73e64da95367ff8ad2ea5
- https://git.kernel.org/stable/c/b7f97cae7ec1b6c3c32843c42be218690d310467
- https://git.kernel.org/stable/c/bcdf3a3664f7d2c4e37e155f30f72ef33f041804
- https://git.kernel.org/stable/c/e1df6cff03aad8c96e55a8b2a991e505c7a3ff6f
- https://git.kernel.org/stable/c/f1e7807df5bf2d42a40266430e9f82f37633cdcf
- https://git.kernel.org/stable/c/f511dd7bf6077aa7afbe72914520553fedaacbb4
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.