CVE-2026-74704
Received Received - Intake

Linux Kernel TCP ACK Filter WARN_ON Bypass

Publication date: 2026-08-22

Last updated on: 2026-08-22

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter The sch_cake ACK filter parses packets to find the TCP header and filter duplicated ACKs if the flow is backlogged. The parsing code contains a WARN_ON(1) which can be triggered by a malformed IP header in certain cases. Depending on the system configuration, this leads either to either spamming dmesg with warnings, or a panic if panic_on_warn is set. The code already correctly skips the offending packet in the branch that triggers the warning, so the WARN_ON itself doesn't really serve any purpose. So just drop it altogether to avoid the inconvenient side effects.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-22
Last Modified
2026-08-22
Generated
2026-08-22
AI Q&A
2026-08-22
EPSS Evaluated
N/A
NVD
CVE-2026-74704
EUVD
EUVD-2026-64391

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves a WARN_ON(1) statement in the Linux kernel's sch_cake ACK filter that triggers when parsing malformed IP headers in TCP packets. The warning can spam dmesg logs or cause a kernel panic if panic_on_warn is enabled, though the packet is already correctly skipped.

Detection Guidance

This vulnerability may cause kernel warnings or panics when malformed packets trigger the WARN_ON(1) in the sch_cake ACK filter. Check kernel logs for warnings or panics related to sch_cake or net/sched using commands like 'dmesg | grep -i cake' or 'journalctl -k | grep -i cake'.

Impact Analysis

The vulnerability can cause system instability by flooding logs with warnings or triggering a kernel panic. This disrupts normal operations and may require a reboot to recover, depending on system configuration.

Mitigation Strategies

Update the Linux kernel to a patched version where the WARN_ON(1) in sch_cake has been removed. If immediate patching is not possible, consider disabling the sch_cake qdisc or adjusting panic_on_warn settings to reduce impact.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74704. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart