Executive brief
The CAKE network packet scheduler in the Linux kernel contains an integer underflow vulnerability in its overhead value handling. An administrator with local access could configure negative overhead values that cause packet length calculations to wrap to large values, resulting in incorrect rate accounting and potentially degraded network traffic shaping or denial of service conditions.
Technical details
The CAKE scheduler accepts signed overhead values (stored as s16) used to adjust packet lengths for rate accounting, but the calculation uses unsigned arithmetic, allowing negative lengths to wrap to large positive values. An attacker with CAP_NET_ADMIN capabilities could set a negative overhead via netlink that, when applied to small packets, causes integer underflow and wraparound, making rate accounting depend on integer overflow behavior rather than intended packet sizes. The vulnerability exists in the cake_calc_overhead() function; the fix clamps the signed overhead adjustment to a minimum value (rate_mpu) before unsigned arithmetic is applied, preventing negative wraparound. A patch was committed upstream by Samuel Moelius in July 2026.
Affected products
- Linux Linux Kernel affected versions include Linux 4.x, 5.x, 6.x, and 7.x kernels with CAKE scheduler support
Timeline
- 2026-08-15: disclosed: CVE-2026-72326 published
- 2026-07-24: patched: Fix committed to stable kernel tree by Greg Kroah-Hartman