CVE-2026-72326
Description
In the Linux kernel, the following vulnerability has been resolved: net/sched: cake: reject overhead values that underflow length CAKE accepts signed overhead values and stores them in an s16, but the adjusted packet length calculation uses unsigned arithmetic. A negative effective length can therefore wrap to a large value. Such configurations make rate accounting depend on integer wraparound rather than on the packet size userspace intended to model. A static netlink lower bound is not enough because packets reaching CAKE can be smaller than any reasonable manual-overhead allowance. Fold the signed overhead adjustment into the existing datapath MPU clamp so negative adjusted lengths are clamped before link-layer framing adjustments.
How to fix
- Linux Linuxf511dd7bf6077aa7afbe72914520553fedaacbb4, e1df6cff03aad8c96e55a8b2a991e505c7a3ff6f, 297f459865360b46a887667cbf3aac6a6f013841, 336c1e414fc0e9844d445174e8ada2a7dd8d1c4b, bcdf3a3664f7d2c4e37e155f30f72ef33f041804, 7aa0e64fea778a9e3df73e64da95367ff8ad2ea5, f1e7807df5bf2d42a40266430e9f82f37633cdcf, b7f97cae7ec1b6c3c32843c42be218690d310467 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | a729b7f0bd5bf4919306556aed614438f5174537 ≤ v < f511dd7bf6077aa7afbe72914520553fedaacbb4, a729b7f0bd5bf4919306556aed614438f5174537 ≤ v < e1df6cff03aad8c96e55a8b2a991e505c7a3ff6f, a729b7f0bd5bf4919306556aed614438f5174537 ≤ v < 297f459865360b46a887667cbf3aac6a6f013841, a729b7f0bd5bf4919306556aed614438f5174537 ≤ v < 336c1e414fc0e9844d445174e8ada2a7dd8d1c4b, a729b7f0bd5bf4919306556aed614438f5174537 ≤ v < bcdf3a3664f7d2c4e37e155f30f72ef33f041804, a729b7f0bd5bf4919306556aed614438f5174537 ≤ v < 7aa0e64fea778a9e3df73e64da95367ff8ad2ea5, a729b7f0bd5bf4919306556aed614438f5174537 ≤ v < f1e7807df5bf2d42a40266430e9f82f37633cdcf, a729b7f0bd5bf4919306556aed614438f5174537 ≤ v < b7f97cae7ec1b6c3c32843c42be218690d310467, 4.19 | f511dd7bf6077aa7afbe72914520553fedaacbb4, e1df6cff03aad8c96e55a8b2a991e505c7a3ff6f, 297f459865360b46a887667cbf3aac6a6f013841, 336c1e414fc0e9844d445174e8ada2a7dd8d1c4b, bcdf3a3664f7d2c4e37e155f30f72ef33f041804, 7aa0e64fea778a9e3df73e64da95367ff8ad2ea5, f1e7807df5bf2d42a40266430e9f82f37633cdcf, b7f97cae7ec1b6c3c32843c42be218690d310467 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.