CVE-2026-72326

net/sched: cake: reject overhead values that underflow length

State: Published
Severity: Not scored
Published: Aug 15, 2026
Updated: Aug 17, 2026
Reserved: Aug 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

net/sched: cake: reject overhead values that underflow length

CAKE accepts signed overhead values and stores them in an s16, but the adjusted packet length calculation uses unsigned arithmetic. A negative effective length can therefore wrap to a large value.

Such configurations make rate accounting depend on integer wraparound rather than on the packet size userspace intended to model. A static netlink lower bound is not enough because packets reaching CAKE can be smaller than any reasonable manual-overhead allowance.

Fold the signed overhead adjustment into the existing datapath MPU clamp so negative adjusted lengths are clamped before link-layer framing adjustments.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	a729b7f0bd5bf4919306556aed614438f5174537 to before f511dd7bf6077aa7afbe72914520553fedaacbb4Affected a729b7f0bd5bf4919306556aed614438f5174537 to before e1df6cff03aad8c96e55a8b2a991e505c7a3ff6fAffected a729b7f0bd5bf4919306556aed614438f5174537 to before 297f459865360b46a887667cbf3aac6a6f013841Affected a729b7f0bd5bf4919306556aed614438f5174537 to before 336c1e414fc0e9844d445174e8ada2a7dd8d1c4bAffected a729b7f0bd5bf4919306556aed614438f5174537 to before bcdf3a3664f7d2c4e37e155f30f72ef33f041804Affected a729b7f0bd5bf4919306556aed614438f5174537 to before 7aa0e64fea778a9e3df73e64da95367ff8ad2ea5Affected a729b7f0bd5bf4919306556aed614438f5174537 to before f1e7807df5bf2d42a40266430e9f82f37633cdcfAffected a729b7f0bd5bf4919306556aed614438f5174537 to before b7f97cae7ec1b6c3c32843c42be218690d310467Affected
LinuxLinux	4.19Affected before 4.19Not affected 5.10.261 through 5.10.Not affected 5.15.212 through 5.15.Not affected 6.1.178 through 6.1.Not affected 6.6.145 through 6.6.Not affected 6.12.97 through 6.12.Not affected 6.18.40 through 6.18.Not affected 7.1.5 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

a729b7f0bd5bf4919306556aed614438f5174537 to before f511dd7bf6077aa7afbe72914520553fedaacbb4Affected
a729b7f0bd5bf4919306556aed614438f5174537 to before e1df6cff03aad8c96e55a8b2a991e505c7a3ff6fAffected
a729b7f0bd5bf4919306556aed614438f5174537 to before 297f459865360b46a887667cbf3aac6a6f013841Affected
a729b7f0bd5bf4919306556aed614438f5174537 to before 336c1e414fc0e9844d445174e8ada2a7dd8d1c4bAffected
a729b7f0bd5bf4919306556aed614438f5174537 to before bcdf3a3664f7d2c4e37e155f30f72ef33f041804Affected
a729b7f0bd5bf4919306556aed614438f5174537 to before 7aa0e64fea778a9e3df73e64da95367ff8ad2ea5Affected
a729b7f0bd5bf4919306556aed614438f5174537 to before f1e7807df5bf2d42a40266430e9f82f37633cdcfAffected
a729b7f0bd5bf4919306556aed614438f5174537 to before b7f97cae7ec1b6c3c32843c42be218690d310467Affected

LinuxLinux

4.19Affected
before 4.19Not affected
5.10.261 through 5.10.*Not affected
5.15.212 through 5.15.*Not affected
6.1.178 through 6.1.*Not affected
6.6.145 through 6.6.*Not affected
6.12.97 through 6.12.*Not affected
6.18.40 through 6.18.*Not affected
7.1.5 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.