CVE-2026-74704 (GCVE-0-2026-74704)
Vulnerability from cvelistv5
Published
2026-08-22 15:33
Modified
2026-08-25 05:41
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter
The sch_cake ACK filter parses packets to find the TCP header and filter
duplicated ACKs if the flow is backlogged. The parsing code contains a
WARN_ON(1) which can be triggered by a malformed IP header in certain
cases. Depending on the system configuration, this leads either to
either spamming dmesg with warnings, or a panic if panic_on_warn is set.
The code already correctly skips the offending packet in the branch that
triggers the warning, so the WARN_ON itself doesn't really serve any
purpose. So just drop it altogether to avoid the inconvenient side
effects.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 8b7138814f29933898ecd31dfc83e35a30ee69f5 Version: 8b7138814f29933898ecd31dfc83e35a30ee69f5 Version: 8b7138814f29933898ecd31dfc83e35a30ee69f5 Version: 8b7138814f29933898ecd31dfc83e35a30ee69f5 Version: 8b7138814f29933898ecd31dfc83e35a30ee69f5 Version: 8b7138814f29933898ecd31dfc83e35a30ee69f5 Version: 8b7138814f29933898ecd31dfc83e35a30ee69f5 Version: 8b7138814f29933898ecd31dfc83e35a30ee69f5 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/sched/sch_cake.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c1693b7844a6c06d31a565e5a494948034dfd235",
"status": "affected",
"version": "8b7138814f29933898ecd31dfc83e35a30ee69f5",
"versionType": "git"
},
{
"lessThan": "a4b52612004a5639c4bfc30ba93ba414b8326e2a",
"status": "affected",
"version": "8b7138814f29933898ecd31dfc83e35a30ee69f5",
"versionType": "git"
},
{
"lessThan": "ae1b2f8e21a41e7c7e75511bea0c4ccc59ec1bd3",
"status": "affected",
"version": "8b7138814f29933898ecd31dfc83e35a30ee69f5",
"versionType": "git"
},
{
"lessThan": "0c4882bff34558d8d53fb04c3e96da5c327c7dc8",
"status": "affected",
"version": "8b7138814f29933898ecd31dfc83e35a30ee69f5",
"versionType": "git"
},
{
"lessThan": "2504a76e5c0694e14e15562730e1339f2d9f9458",
"status": "affected",
"version": "8b7138814f29933898ecd31dfc83e35a30ee69f5",
"versionType": "git"
},
{
"lessThan": "cd2f1d9fe8a507c2dc86ad326fe221f121c47734",
"status": "affected",
"version": "8b7138814f29933898ecd31dfc83e35a30ee69f5",
"versionType": "git"
},
{
"lessThan": "a1ae353d8355407c1bea971d1c1af5e7f242bb7d",
"status": "affected",
"version": "8b7138814f29933898ecd31dfc83e35a30ee69f5",
"versionType": "git"
},
{
"lessThan": "2a33516f9ef59ad11844d4fc152f889449b5daf3",
"status": "affected",
"version": "8b7138814f29933898ecd31dfc83e35a30ee69f5",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/sched/sch_cake.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.19"
},
{
"lessThan": "4.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.152",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.104",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.152",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.104",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.45",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "4.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter\n\nThe sch_cake ACK filter parses packets to find the TCP header and filter\nduplicated ACKs if the flow is backlogged. The parsing code contains a\nWARN_ON(1) which can be triggered by a malformed IP header in certain\ncases. Depending on the system configuration, this leads either to\neither spamming dmesg with warnings, or a panic if panic_on_warn is set.\n\nThe code already correctly skips the offending packet in the branch that\ntriggers the warning, so the WARN_ON itself doesn\u0027t really serve any\npurpose. So just drop it altogether to avoid the inconvenient side\neffects."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The bug fires in cake_ack_filter() during cake_enqueue() on the packet datapath; remotely sourced traffic through an internet-facing SQM/OpenWrt gateway with CAKE ingress/egress and ack-filter enabled reaches the vulnerable ACK-filter parsing loop without any local syscall or netlink operation by the attacker.\nAC:L - Once CAKE ack-filter is configured, an attacker reliably crafts malformed encapsulated IP headers (e.g., IPv4 carrying an inner header with invalid version) and floods matching TCP ACKs to keep the flow backlogged, deterministically hitting the unsupported-version branch on each qualifying enqueue.\nPR:N - Installing CAKE with ack-filter requires CAP_NET_ADMIN, but triggering the bug on a preconfigured edge router or gateway needs no credentials on the target; an unauthenticated remote peer only sends crafted packets, consistent with CNA precedent for packet-driven tc issues (e.g., CVE-2026-72256).\nUI:N - Exploitation requires only attacker-generated packets delivered through the shaped interface; no victim login, file open, mount, or other interactive action is needed beyond normal network traffic reaching the CAKE-managed path.\nS:U - Impact is confined to kernel traffic-shaping code and warning/panic handling within the affected host; it does not cross VM, container, IOMMU, or other security-authority boundaries.\nC:L - Each WARN_ON(1) emits a kernel backtrace that can disclose kernel text and module pointers via dmesg/syslog to the attacker, constituting limited information disclosure even though no out-of-bounds read or use-after-free occurs.\nI:N - The failure path only executes continue and skips the malformed queued packet; there is no memory corruption, type confusion, or attacker-controlled modification of kernel or network data beyond normal ACK-filter drop behavior.\nA:H - Each matching malformed packet triggers WARN_ON(1) in cake_ack_filter(), flooding kernel warnings and, when panic_on_warn is enabled, invoking check_panic_on_warn() to kernel panic, yielding repeatable denial of service on CAKE-managed router and gateway paths."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T05:41:47.538Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c1693b7844a6c06d31a565e5a494948034dfd235"
},
{
"url": "https://git.kernel.org/stable/c/a4b52612004a5639c4bfc30ba93ba414b8326e2a"
},
{
"url": "https://git.kernel.org/stable/c/ae1b2f8e21a41e7c7e75511bea0c4ccc59ec1bd3"
},
{
"url": "https://git.kernel.org/stable/c/0c4882bff34558d8d53fb04c3e96da5c327c7dc8"
},
{
"url": "https://git.kernel.org/stable/c/2504a76e5c0694e14e15562730e1339f2d9f9458"
},
{
"url": "https://git.kernel.org/stable/c/cd2f1d9fe8a507c2dc86ad326fe221f121c47734"
},
{
"url": "https://git.kernel.org/stable/c/a1ae353d8355407c1bea971d1c1af5e7f242bb7d"
},
{
"url": "https://git.kernel.org/stable/c/2a33516f9ef59ad11844d4fc152f889449b5daf3"
}
],
"title": "net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74704",
"datePublished": "2026-08-22T15:33:03.491Z",
"dateReserved": "2026-08-15T05:44:03.927Z",
"dateUpdated": "2026-08-25T05:41:47.538Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…