CVE-2026-72326
Received Received - Intake

Linux Kernel CAKE Queue Packet Length Underflow Vulnerability

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net/sched: cake: reject overhead values that underflow length CAKE accepts signed overhead values and stores them in an s16, but the adjusted packet length calculation uses unsigned arithmetic. A negative effective length can therefore wrap to a large value. Such configurations make rate accounting depend on integer wraparound rather than on the packet size userspace intended to model. A static netlink lower bound is not enough because packets reaching CAKE can be smaller than any reasonable manual-overhead allowance. Fold the signed overhead adjustment into the existing datapath MPU clamp so negative adjusted lengths are clamped before link-layer framing adjustments.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-15
Last Modified
2026-08-15
Generated
2026-08-15
AI Q&A
2026-08-15
EPSS Evaluated
N/A
NVD
CVE-2026-72326
EUVD
EUVD-2026-59225

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves the CAKE traffic control algorithm incorrectly handling negative overhead values. When CAKE accepts signed overhead values stored as a 16-bit signed integer, the adjusted packet length calculation uses unsigned arithmetic. This can cause a negative effective length to wrap around to a large positive value, leading to incorrect rate accounting based on integer wraparound rather than actual packet sizes.

Detection Guidance

This vulnerability affects the Linux kernel's CAKE traffic control module. Detection requires checking kernel configurations and running specific commands to inspect CAKE settings and packet handling. Look for CAKE qdisc usage with negative overhead values or unusual packet length calculations.

Impact Analysis

This vulnerability could allow attackers to manipulate traffic shaping and rate limiting in systems using the CAKE algorithm. By exploiting the integer wraparound, they might bypass intended bandwidth controls, cause incorrect accounting of network traffic, or disrupt network performance and fairness in resource allocation.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for this issue. Avoid using negative overhead values in CAKE configurations. Review and adjust any existing CAKE qdisc setups to ensure overhead values are non-negative.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72326. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart