CVE-2026-72326

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/sched: cake: reject overhead values that underflow length

CAKE accepts signed overhead values and stores them in an s16, but the

adjusted packet length calculation uses unsigned arithmetic. A negative

effective length can therefore wrap to a large value.

Such configurations make rate accounting depend on integer wraparound

rather than on the packet size userspace intended to model. A static

netlink lower bound is not enough because packets reaching CAKE can be

smaller than any reasonable manual-overhead allowance.

Fold the signed overhead adjustment into the existing datapath MPU clamp

so negative adjusted lengths are clamped before link-layer framing

adjustments.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References