CVE-2026-74704

net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter

State: Published
Severity: 8.2 High
Published: Aug 22, 2026
Updated: Oct 16, 2026
Reserved: Aug 15, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter

The sch_cake ACK filter parses packets to find the TCP header and filter duplicated ACKs if the flow is backlogged. The parsing code contains a WARN_ON(1) which can be triggered by a malformed IP header in certain cases. Depending on the system configuration, this leads either to either spamming dmesg with warnings, or a panic if panic_on_warn is set.

The code already correctly skips the offending packet in the branch that triggers the warning, so the WARN_ON itself doesn't really serve any purpose. So just drop it altogether to avoid the inconvenient side effects.

Scores

CVSS	Score	Vector	Source
3.1	8.2 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	8b7138814f29933898ecd31dfc83e35a30ee69f5 to before c1693b7844a6c06d31a565e5a494948034dfd235Affected 8b7138814f29933898ecd31dfc83e35a30ee69f5 to before a4b52612004a5639c4bfc30ba93ba414b8326e2aAffected 8b7138814f29933898ecd31dfc83e35a30ee69f5 to before ae1b2f8e21a41e7c7e75511bea0c4ccc59ec1bd3Affected 8b7138814f29933898ecd31dfc83e35a30ee69f5 to before 0c4882bff34558d8d53fb04c3e96da5c327c7dc8Affected 8b7138814f29933898ecd31dfc83e35a30ee69f5 to before 2504a76e5c0694e14e15562730e1339f2d9f9458Affected 8b7138814f29933898ecd31dfc83e35a30ee69f5 to before cd2f1d9fe8a507c2dc86ad326fe221f121c47734Affected 8b7138814f29933898ecd31dfc83e35a30ee69f5 to before a1ae353d8355407c1bea971d1c1af5e7f242bb7dAffected 8b7138814f29933898ecd31dfc83e35a30ee69f5 to before 2a33516f9ef59ad11844d4fc152f889449b5daf3Affected
LinuxLinux	4.19Affected before 4.19Not affected 5.10.265 through 5.10.Not affected 5.15.216 through 5.15.Not affected 6.1.183 through 6.1.Not affected 6.6.152 through 6.6.Not affected 6.12.104 through 6.12.Not affected 6.18.45 through 6.18.Not affected 7.1.9 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

8b7138814f29933898ecd31dfc83e35a30ee69f5 to before c1693b7844a6c06d31a565e5a494948034dfd235Affected
8b7138814f29933898ecd31dfc83e35a30ee69f5 to before a4b52612004a5639c4bfc30ba93ba414b8326e2aAffected
8b7138814f29933898ecd31dfc83e35a30ee69f5 to before ae1b2f8e21a41e7c7e75511bea0c4ccc59ec1bd3Affected
8b7138814f29933898ecd31dfc83e35a30ee69f5 to before 0c4882bff34558d8d53fb04c3e96da5c327c7dc8Affected
8b7138814f29933898ecd31dfc83e35a30ee69f5 to before 2504a76e5c0694e14e15562730e1339f2d9f9458Affected
8b7138814f29933898ecd31dfc83e35a30ee69f5 to before cd2f1d9fe8a507c2dc86ad326fe221f121c47734Affected
8b7138814f29933898ecd31dfc83e35a30ee69f5 to before a1ae353d8355407c1bea971d1c1af5e7f242bb7dAffected
8b7138814f29933898ecd31dfc83e35a30ee69f5 to before 2a33516f9ef59ad11844d4fc152f889449b5daf3Affected

LinuxLinux

4.19Affected
before 4.19Not affected
5.10.265 through 5.10.*Not affected
5.15.216 through 5.15.*Not affected
6.1.183 through 6.1.*Not affected
6.6.152 through 6.6.*Not affected
6.12.104 through 6.12.*Not affected
6.18.45 through 6.18.*Not affected
7.1.9 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.