Vulnerability-Lookup

CVE-2026-74704 (GCVE-0-2026-74704)

Vulnerability from cvelistv5 – Published: 2026-08-22 15:33 – Updated: 2026-08-25 05:41

Title

net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter

Summary

In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter The sch_cake ACK filter parses packets to find the TCP header and filter duplicated ACKs if the flow is backlogged. The parsing code contains a WARN_ON(1) which can be triggered by a malformed IP header in certain cases. Depending on the system configuration, this leads either to either spamming dmesg with warnings, or a panic if panic_on_warn is set. The code already correctly skips the offending packet in the branch that triggers the warning, so the WARN_ON itself doesn't really serve any purpose. So just drop it altogether to avoid the inconvenient side effects.

Severity

8.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Assigner

Linux mitre root

References

8 references

URL	Tags
https://git.kernel.org/stable/c/c1693b7844a6c06d3…
https://git.kernel.org/stable/c/a4b52612004a5639c…
https://git.kernel.org/stable/c/ae1b2f8e21a41e7c7…
https://git.kernel.org/stable/c/0c4882bff34558d8d…
https://git.kernel.org/stable/c/2504a76e5c0694e14…
https://git.kernel.org/stable/c/cd2f1d9fe8a507c2d…
https://git.kernel.org/stable/c/a1ae353d8355407c1…
https://git.kernel.org/stable/c/2a33516f9ef59ad11…

Impacted products

2 products

Vendor	Product	Version	CPE status
Linux	Linux	Affected: 8b7138814f29933898ecd31dfc83e35a30ee69f5 , < c1693b7844a6c06d31a565e5a494948034dfd235 (git) Affected: 8b7138814f29933898ecd31dfc83e35a30ee69f5 , < a4b52612004a5639c4bfc30ba93ba414b8326e2a (git) Affected: 8b7138814f29933898ecd31dfc83e35a30ee69f5 , < ae1b2f8e21a41e7c7e75511bea0c4ccc59ec1bd3 (git) Affected: 8b7138814f29933898ecd31dfc83e35a30ee69f5 , < 0c4882bff34558d8d53fb04c3e96da5c327c7dc8 (git) Affected: 8b7138814f29933898ecd31dfc83e35a30ee69f5 , < 2504a76e5c0694e14e15562730e1339f2d9f9458 (git) Affected: 8b7138814f29933898ecd31dfc83e35a30ee69f5 , < cd2f1d9fe8a507c2dc86ad326fe221f121c47734 (git) Affected: 8b7138814f29933898ecd31dfc83e35a30ee69f5 , < a1ae353d8355407c1bea971d1c1af5e7f242bb7d (git) Affected: 8b7138814f29933898ecd31dfc83e35a30ee69f5 , < 2a33516f9ef59ad11844d4fc152f889449b5daf3 (git)	guessed
Linux	Linux	Affected: 4.19 Unaffected: 0 , < 4.19 (semver) Unaffected: 5.10.265 , ≤ 5.10.* (semver) Unaffected: 5.15.216 , ≤ 5.15.* (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.152 , ≤ 6.6.* (semver) Unaffected: 6.12.104 , ≤ 6.12.* (semver) Unaffected: 6.18.45 , ≤ 6.18.* (semver) Unaffected: 7.1.9 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sched/sch_cake.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c1693b7844a6c06d31a565e5a494948034dfd235",
              "status": "affected",
              "version": "8b7138814f29933898ecd31dfc83e35a30ee69f5",
              "versionType": "git"
            },
            {
              "lessThan": "a4b52612004a5639c4bfc30ba93ba414b8326e2a",
              "status": "affected",
              "version": "8b7138814f29933898ecd31dfc83e35a30ee69f5",
              "versionType": "git"
            },
            {
              "lessThan": "ae1b2f8e21a41e7c7e75511bea0c4ccc59ec1bd3",
              "status": "affected",
              "version": "8b7138814f29933898ecd31dfc83e35a30ee69f5",
              "versionType": "git"
            },
            {
              "lessThan": "0c4882bff34558d8d53fb04c3e96da5c327c7dc8",
              "status": "affected",
              "version": "8b7138814f29933898ecd31dfc83e35a30ee69f5",
              "versionType": "git"
            },
            {
              "lessThan": "2504a76e5c0694e14e15562730e1339f2d9f9458",
              "status": "affected",
              "version": "8b7138814f29933898ecd31dfc83e35a30ee69f5",
              "versionType": "git"
            },
            {
              "lessThan": "cd2f1d9fe8a507c2dc86ad326fe221f121c47734",
              "status": "affected",
              "version": "8b7138814f29933898ecd31dfc83e35a30ee69f5",
              "versionType": "git"
            },
            {
              "lessThan": "a1ae353d8355407c1bea971d1c1af5e7f242bb7d",
              "status": "affected",
              "version": "8b7138814f29933898ecd31dfc83e35a30ee69f5",
              "versionType": "git"
            },
            {
              "lessThan": "2a33516f9ef59ad11844d4fc152f889449b5daf3",
              "status": "affected",
              "version": "8b7138814f29933898ecd31dfc83e35a30ee69f5",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sched/sch_cake.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.19"
            },
            {
              "lessThan": "4.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.152",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter\n\nThe sch_cake ACK filter parses packets to find the TCP header and filter\nduplicated ACKs if the flow is backlogged. The parsing code contains a\nWARN_ON(1) which can be triggered by a malformed IP header in certain\ncases. Depending on the system configuration, this leads either to\neither spamming dmesg with warnings, or a panic if panic_on_warn is set.\n\nThe code already correctly skips the offending packet in the branch that\ntriggers the warning, so the WARN_ON itself doesn\u0027t really serve any\npurpose. So just drop it altogether to avoid the inconvenient side\neffects."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug fires in cake_ack_filter() during cake_enqueue() on the packet datapath; remotely sourced traffic through an internet-facing SQM/OpenWrt gateway with CAKE ingress/egress and ack-filter enabled reaches the vulnerable ACK-filter parsing loop without any local syscall or netlink operation by the attacker.\nAC:L - Once CAKE ack-filter is configured, an attacker reliably crafts malformed encapsulated IP headers (e.g., IPv4 carrying an inner header with invalid version) and floods matching TCP ACKs to keep the flow backlogged, deterministically hitting the unsupported-version branch on each qualifying enqueue.\nPR:N - Installing CAKE with ack-filter requires CAP_NET_ADMIN, but triggering the bug on a preconfigured edge router or gateway needs no credentials on the target; an unauthenticated remote peer only sends crafted packets, consistent with CNA precedent for packet-driven tc issues (e.g., CVE-2026-72256).\nUI:N - Exploitation requires only attacker-generated packets delivered through the shaped interface; no victim login, file open, mount, or other interactive action is needed beyond normal network traffic reaching the CAKE-managed path.\nS:U - Impact is confined to kernel traffic-shaping code and warning/panic handling within the affected host; it does not cross VM, container, IOMMU, or other security-authority boundaries.\nC:L - Each WARN_ON(1) emits a kernel backtrace that can disclose kernel text and module pointers via dmesg/syslog to the attacker, constituting limited information disclosure even though no out-of-bounds read or use-after-free occurs.\nI:N - The failure path only executes continue and skips the malformed queued packet; there is no memory corruption, type confusion, or attacker-controlled modification of kernel or network data beyond normal ACK-filter drop behavior.\nA:H - Each matching malformed packet triggers WARN_ON(1) in cake_ack_filter(), flooding kernel warnings and, when panic_on_warn is enabled, invoking check_panic_on_warn() to kernel panic, yielding repeatable denial of service on CAKE-managed router and gateway paths."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T05:41:47.538Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c1693b7844a6c06d31a565e5a494948034dfd235"
        },
        {
          "url": "https://git.kernel.org/stable/c/a4b52612004a5639c4bfc30ba93ba414b8326e2a"
        },
        {
          "url": "https://git.kernel.org/stable/c/ae1b2f8e21a41e7c7e75511bea0c4ccc59ec1bd3"
        },
        {
          "url": "https://git.kernel.org/stable/c/0c4882bff34558d8d53fb04c3e96da5c327c7dc8"
        },
        {
          "url": "https://git.kernel.org/stable/c/2504a76e5c0694e14e15562730e1339f2d9f9458"
        },
        {
          "url": "https://git.kernel.org/stable/c/cd2f1d9fe8a507c2dc86ad326fe221f121c47734"
        },
        {
          "url": "https://git.kernel.org/stable/c/a1ae353d8355407c1bea971d1c1af5e7f242bb7d"
        },
        {
          "url": "https://git.kernel.org/stable/c/2a33516f9ef59ad11844d4fc152f889449b5daf3"
        }
      ],
      "title": "net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74704",
    "datePublished": "2026-08-22T15:33:03.491Z",
    "dateReserved": "2026-08-15T05:44:03.927Z",
    "dateUpdated": "2026-08-25T05:41:47.538Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74704",
      "date": "2026-08-25",
      "epss": "0.00443",
      "percentile": "0.36734"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-24T14:45:05.000Z",
      "cve": "CVE-2026-74704",
      "id": "msrc_CVE-2026-74704",
      "initial_release_date": "2026-08-24T01:01:36.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-74704.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-74704\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-22T16:16:45.090\",\"lastModified\":\"2026-08-25T06:18:54.583\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter\\n\\nThe sch_cake ACK filter parses packets to find the TCP header and filter\\nduplicated ACKs if the flow is backlogged. The parsing code contains a\\nWARN_ON(1) which can be triggered by a malformed IP header in certain\\ncases. Depending on the system configuration, this leads either to\\neither spamming dmesg with warnings, or a panic if panic_on_warn is set.\\n\\nThe code already correctly skips the offending packet in the branch that\\ntriggers the warning, so the WARN_ON itself doesn\u0027t really serve any\\npurpose. So just drop it altogether to avoid the inconvenient side\\neffects.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/sched/sch_cake.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"8b7138814f29933898ecd31dfc83e35a30ee69f5\",\"lessThan\":\"c1693b7844a6c06d31a565e5a494948034dfd235\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8b7138814f29933898ecd31dfc83e35a30ee69f5\",\"lessThan\":\"a4b52612004a5639c4bfc30ba93ba414b8326e2a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8b7138814f29933898ecd31dfc83e35a30ee69f5\",\"lessThan\":\"ae1b2f8e21a41e7c7e75511bea0c4ccc59ec1bd3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8b7138814f29933898ecd31dfc83e35a30ee69f5\",\"lessThan\":\"0c4882bff34558d8d53fb04c3e96da5c327c7dc8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8b7138814f29933898ecd31dfc83e35a30ee69f5\",\"lessThan\":\"2504a76e5c0694e14e15562730e1339f2d9f9458\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8b7138814f29933898ecd31dfc83e35a30ee69f5\",\"lessThan\":\"cd2f1d9fe8a507c2dc86ad326fe221f121c47734\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8b7138814f29933898ecd31dfc83e35a30ee69f5\",\"lessThan\":\"a1ae353d8355407c1bea971d1c1af5e7f242bb7d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8b7138814f29933898ecd31dfc83e35a30ee69f5\",\"lessThan\":\"2a33516f9ef59ad11844d4fc152f889449b5daf3\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/sched/sch_cake.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.19\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.19\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.265\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.216\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.183\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.152\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.104\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.45\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.9\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H\",\"baseScore\":8.2,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":4.2}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0c4882bff34558d8d53fb04c3e96da5c327c7dc8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/2504a76e5c0694e14e15562730e1339f2d9f9458\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/2a33516f9ef59ad11844d4fc152f889449b5daf3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a1ae353d8355407c1bea971d1c1af5e7f242bb7d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a4b52612004a5639c4bfc30ba93ba414b8326e2a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ae1b2f8e21a41e7c7e75511bea0c4ccc59ec1bd3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c1693b7844a6c06d31a565e5a494948034dfd235\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/cd2f1d9fe8a507c2dc86ad326fe221f121c47734\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-25T08:55:01+00:00",
      "cve": "CVE-2026-74704",
      "id": "CVE-2026-74704",
      "initial_release_date": "2026-08-22T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74704.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "not set",
      "current_release_date": "2026-08-23T00:04:19Z",
      "cve": "CVE-2026-74704",
      "id": "CVE-2026-74704",
      "initial_release_date": "2026-08-23T00:04:19Z",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-74704",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-74704.json",
      "version": "2"
    }
  }
}

FKIE_CVE-2026-74704

Vulnerability from fkie_nvd - Published: 2026-08-22 16:16 - Updated: 2026-08-25 06:18

Severity

8.2 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Summary

References

	URL	Tags
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/0c4882bff34558d8d53fb04c3e96da5c327c7dc8
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/2504a76e5c0694e14e15562730e1339f2d9f9458
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/2a33516f9ef59ad11844d4fc152f889449b5daf3
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/a1ae353d8355407c1bea971d1c1af5e7f242bb7d
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/a4b52612004a5639c4bfc30ba93ba414b8326e2a
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/ae1b2f8e21a41e7c7e75511bea0c4ccc59ec1bd3
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/c1693b7844a6c06d31a565e5a494948034dfd235
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/cd2f1d9fe8a507c2dc86ad326fe221f121c47734

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sched/sch_cake.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c1693b7844a6c06d31a565e5a494948034dfd235",
              "status": "affected",
              "version": "8b7138814f29933898ecd31dfc83e35a30ee69f5",
              "versionType": "git"
            },
            {
              "lessThan": "a4b52612004a5639c4bfc30ba93ba414b8326e2a",
              "status": "affected",
              "version": "8b7138814f29933898ecd31dfc83e35a30ee69f5",
              "versionType": "git"
            },
            {
              "lessThan": "ae1b2f8e21a41e7c7e75511bea0c4ccc59ec1bd3",
              "status": "affected",
              "version": "8b7138814f29933898ecd31dfc83e35a30ee69f5",
              "versionType": "git"
            },
            {
              "lessThan": "0c4882bff34558d8d53fb04c3e96da5c327c7dc8",
              "status": "affected",
              "version": "8b7138814f29933898ecd31dfc83e35a30ee69f5",
              "versionType": "git"
            },
            {
              "lessThan": "2504a76e5c0694e14e15562730e1339f2d9f9458",
              "status": "affected",
              "version": "8b7138814f29933898ecd31dfc83e35a30ee69f5",
              "versionType": "git"
            },
            {
              "lessThan": "cd2f1d9fe8a507c2dc86ad326fe221f121c47734",
              "status": "affected",
              "version": "8b7138814f29933898ecd31dfc83e35a30ee69f5",
              "versionType": "git"
            },
            {
              "lessThan": "a1ae353d8355407c1bea971d1c1af5e7f242bb7d",
              "status": "affected",
              "version": "8b7138814f29933898ecd31dfc83e35a30ee69f5",
              "versionType": "git"
            },
            {
              "lessThan": "2a33516f9ef59ad11844d4fc152f889449b5daf3",
              "status": "affected",
              "version": "8b7138814f29933898ecd31dfc83e35a30ee69f5",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sched/sch_cake.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.19"
            },
            {
              "lessThan": "4.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter\n\nThe sch_cake ACK filter parses packets to find the TCP header and filter\nduplicated ACKs if the flow is backlogged. The parsing code contains a\nWARN_ON(1) which can be triggered by a malformed IP header in certain\ncases. Depending on the system configuration, this leads either to\neither spamming dmesg with warnings, or a panic if panic_on_warn is set.\n\nThe code already correctly skips the offending packet in the branch that\ntriggers the warning, so the WARN_ON itself doesn\u0027t really serve any\npurpose. So just drop it altogether to avoid the inconvenient side\neffects."
    }
  ],
  "id": "CVE-2026-74704",
  "lastModified": "2026-08-25T06:18:54.583",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.2,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 4.2,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-08-22T16:16:45.090",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/0c4882bff34558d8d53fb04c3e96da5c327c7dc8"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/2504a76e5c0694e14e15562730e1339f2d9f9458"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/2a33516f9ef59ad11844d4fc152f889449b5daf3"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/a1ae353d8355407c1bea971d1c1af5e7f242bb7d"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/a4b52612004a5639c4bfc30ba93ba414b8326e2a"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/ae1b2f8e21a41e7c7e75511bea0c4ccc59ec1bd3"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/c1693b7844a6c06d31a565e5a494948034dfd235"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/cd2f1d9fe8a507c2dc86ad326fe221f121c47734"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}

GHSA-5X69-69GJ-GG3F

Vulnerability from github – Published: 2026-08-22 18:30 – Updated: 2026-08-25 06:31

Details

In the Linux kernel, the following vulnerability has been resolved:

net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter

The sch_cake ACK filter parses packets to find the TCP header and filter duplicated ACKs if the flow is backlogged. The parsing code contains a WARN_ON(1) which can be triggered by a malformed IP header in certain cases. Depending on the system configuration, this leads either to either spamming dmesg with warnings, or a panic if panic_on_warn is set.

The code already correctly skips the offending packet in the branch that triggers the warning, so the WARN_ON itself doesn't really serve any purpose. So just drop it altogether to avoid the inconvenient side effects.

Severity

8.2 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-74704"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-22T16:16:45Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter\n\nThe sch_cake ACK filter parses packets to find the TCP header and filter\nduplicated ACKs if the flow is backlogged. The parsing code contains a\nWARN_ON(1) which can be triggered by a malformed IP header in certain\ncases. Depending on the system configuration, this leads either to\neither spamming dmesg with warnings, or a panic if panic_on_warn is set.\n\nThe code already correctly skips the offending packet in the branch that\ntriggers the warning, so the WARN_ON itself doesn\u0027t really serve any\npurpose. So just drop it altogether to avoid the inconvenient side\neffects.",
  "id": "GHSA-5x69-69gj-gg3f",
  "modified": "2026-08-25T06:31:29Z",
  "published": "2026-08-22T18:30:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74704"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/0c4882bff34558d8d53fb04c3e96da5c327c7dc8"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/2504a76e5c0694e14e15562730e1339f2d9f9458"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/2a33516f9ef59ad11844d4fc152f889449b5daf3"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/a1ae353d8355407c1bea971d1c1af5e7f242bb7d"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/a4b52612004a5639c4bfc30ba93ba414b8326e2a"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/ae1b2f8e21a41e7c7e75511bea0c4ccc59ec1bd3"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/c1693b7844a6c06d31a565e5a494948034dfd235"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/cd2f1d9fe8a507c2dc86ad326fe221f121c47734"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

MSRC_CVE-2026-74704

Vulnerability from csaf_microsoft - Published: 2026-08-24 01:01 - Updated: 2026-08-24 14:45

Summary

net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter

Notes

Additional Resources: To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle

Disclaimer: The information provided in the Microsoft Knowledge Base is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

CVE-2026-74704

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Unresolved product id: 17084-1		—	None Available

References

4 references

URL	Category
https://msrc.microsoft.com/csaf/vex/2026/msrc_cve…	self
https://support.microsoft.com/lifecycle	external
https://www.first.org/cvss	external
https://msrc.microsoft.com/csaf/vex/2026/msrc_cve…	self

JSON

To clipboard

{
  "document": {
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Public",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "The information provided in the Microsoft Knowledge Base is provided \\\"as is\\\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.",
        "title": "Disclaimer"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "secure@microsoft.com",
      "name": "Microsoft Security Response Center",
      "namespace": "https://msrc.microsoft.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "CVE-2026-74704 net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter - VEX",
        "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-74704.json"
      },
      {
        "category": "external",
        "summary": "Microsoft Support Lifecycle",
        "url": "https://support.microsoft.com/lifecycle"
      },
      {
        "category": "external",
        "summary": "Common Vulnerability Scoring System",
        "url": "https://www.first.org/cvss"
      }
    ],
    "title": "net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter",
    "tracking": {
      "current_release_date": "2026-08-24T14:45:05.000Z",
      "generator": {
        "date": "2026-08-25T07:02:58.279Z",
        "engine": {
          "name": "MSRC Generator",
          "version": "1.0"
        }
      },
      "id": "msrc_CVE-2026-74704",
      "initial_release_date": "2026-08-24T01:01:36.000Z",
      "revision_history": [
        {
          "date": "2026-08-24T01:01:36.000Z",
          "legacy_version": "1",
          "number": "1",
          "summary": "Information published."
        },
        {
          "date": "2026-08-24T14:45:05.000Z",
          "legacy_version": "2",
          "number": "2",
          "summary": "Information published."
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "3.0",
                "product": {
                  "name": "Azure Linux 3.0",
                  "product_id": "17084"
                }
              }
            ],
            "category": "product_name",
            "name": "Azure Linux"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "azl3 kernel 0:6.6.150.1-1.azl3",
                "product": {
                  "name": "azl3 kernel 0:6.6.150.1-1.azl3",
                  "product_id": "1"
                }
              }
            ],
            "category": "product_name",
            "name": "kernel"
          }
        ],
        "category": "vendor",
        "name": "Microsoft"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 kernel 0:6.6.150.1-1.azl3 as a component of Azure Linux 3.0",
          "product_id": "17084-1"
        },
        "product_reference": "1",
        "relates_to_product_reference": "17084"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-74704",
      "notes": [
        {
          "category": "general",
          "text": "Linux",
          "title": "Assigning CNA"
        }
      ],
      "product_status": {
        "known_affected": [
          "17084-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-74704 net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter - VEX",
          "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-74704.json"
        }
      ],
      "remediations": [
        {
          "category": "none_available",
          "date": "2026-08-24T01:01:36.000Z",
          "details": "There is no fix available for this vulnerability as of now",
          "product_ids": [
            "17084-1"
          ]
        }
      ],
      "title": "net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-74704 (GCVE-0-2026-74704)

FKIE_CVE-2026-74704

GHSA-5X69-69GJ-GG3F

MSRC_CVE-2026-74704

Tags

Sightings

Nomenclature