CVE-2026-72326

Summary

In the Linux kernel, the following vulnerability has been resolved:

net/sched: cake: reject overhead values that underflow length

CAKE accepts signed overhead values and stores them in an s16, but the adjusted packet length calculation uses unsigned arithmetic. A negative effective length can therefore wrap to a large value.

Such configurations make rate accounting depend on integer wraparound rather than on the packet size userspace intended to model. A static netlink lower bound is not enough because packets reaching CAKE can be smaller than any reasonable manual-overhead allowance.

Fold the signed overhead adjustment into the existing datapath MPU clamp so negative adjusted lengths are clamped before link-layer framing adjustments.

Affected Software

VendorProductVersion RangeStatus
LinuxLinuxa729b7f0bd5bf4919306556aed614438f5174537 < f511dd7bf6077aa7afbe72914520553fedaacbb4affected
LinuxLinuxa729b7f0bd5bf4919306556aed614438f5174537 < e1df6cff03aad8c96e55a8b2a991e505c7a3ff6faffected
LinuxLinuxa729b7f0bd5bf4919306556aed614438f5174537 < 297f459865360b46a887667cbf3aac6a6f013841affected
LinuxLinuxa729b7f0bd5bf4919306556aed614438f5174537 < 336c1e414fc0e9844d445174e8ada2a7dd8d1c4baffected
LinuxLinuxa729b7f0bd5bf4919306556aed614438f5174537 < bcdf3a3664f7d2c4e37e155f30f72ef33f041804affected
LinuxLinuxa729b7f0bd5bf4919306556aed614438f5174537 < 7aa0e64fea778a9e3df73e64da95367ff8ad2ea5affected
LinuxLinuxa729b7f0bd5bf4919306556aed614438f5174537 < f1e7807df5bf2d42a40266430e9f82f37633cdcfaffected
LinuxLinuxa729b7f0bd5bf4919306556aed614438f5174537 < b7f97cae7ec1b6c3c32843c42be218690d310467affected
LinuxLinux4.19affected
LinuxLinux0 < 4.19unaffected
LinuxLinux5.10.261 <= 5.10.*unaffected
LinuxLinux5.15.212 <= 5.15.*unaffected
LinuxLinux6.1.178 <= 6.1.*unaffected
LinuxLinux6.6.145 <= 6.6.*unaffected
LinuxLinux6.12.97 <= 6.12.*unaffected
LinuxLinux6.18.40 <= 6.18.*unaffected
LinuxLinux7.1.5 <= 7.1.*unaffected
LinuxLinux7.2 <= *unaffected

Weaknesses

References