Executive brief
The Linux kernel's CAKE (Common Applications Kept Enhanced) queue discipline includes an ACK filter used to optimize network performance for backlogged flows. A malformed IP packet header can trigger an unconditional warning that either floods system logs or causes a kernel panic if panic-on-warn is enabled, disrupting network services and system availability.
Technical details
The vulnerability exists in the sch_cake queue discipline's ACK filter (net/sched/sch_cake.c), which parses packets to identify and filter duplicate ACKs for backlogged flows. The parsing code contained an unconditional WARN_ON(1) statement that triggers when the IP header parsing encounters an unexpected state (neither IPv4 nor IPv6). A remote attacker can send a crafted malformed IP packet to trigger this warning, which either spams dmesg with kernel warnings degrading system performance, or causes a kernel panic if panic_on_warn is enabled in the system configuration. The vulnerable code already correctly handles the malformed packet by skipping it via the continue statement, making the warning itself unnecessary. The fix removes the WARN_ON(1) entirely without affecting packet handling logic.
Affected products
- Linux Linux kernel multiple versions prior to patch
Timeline
- 2026-08-22: disclosed
- 2026-07-29: patched: Patch committed upstream; stable backports followed