{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74704", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.927Z", "datePublished": "2026-08-22T15:33:03.491Z", "dateUpdated": "2026-08-25T05:41:47.538Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-25T05:41:47.538Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter\n\nThe sch_cake ACK filter parses packets to find the TCP header and filter\nduplicated ACKs if the flow is backlogged. The parsing code contains a\nWARN_ON(1) which can be triggered by a malformed IP header in certain\ncases. Depending on the system configuration, this leads either to\neither spamming dmesg with warnings, or a panic if panic_on_warn is set.\n\nThe code already correctly skips the offending packet in the branch that\ntriggers the warning, so the WARN_ON itself doesn't really serve any\npurpose. So just drop it altogether to avoid the inconvenient side\neffects."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "baseScore": 8.2, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:N - The bug fires in cake_ack_filter() during cake_enqueue() on the packet datapath; remotely sourced traffic through an internet-facing SQM/OpenWrt gateway with CAKE ingress/egress and ack-filter enabled reaches the vulnerable ACK-filter parsing loop without any local syscall or netlink operation by the attacker.\nAC:L - Once CAKE ack-filter is configured, an attacker reliably crafts malformed encapsulated IP headers (e.g., IPv4 carrying an inner header with invalid version) and floods matching TCP ACKs to keep the flow backlogged, deterministically hitting the unsupported-version branch on each qualifying enqueue.\nPR:N - Installing CAKE with ack-filter requires CAP_NET_ADMIN, but triggering the bug on a preconfigured edge router or gateway needs no credentials on the target; an unauthenticated remote peer only sends crafted packets, consistent with CNA precedent for packet-driven tc issues (e.g., CVE-2026-72256).\nUI:N - Exploitation requires only attacker-generated packets delivered through the shaped interface; no victim login, file open, mount, or other interactive action is needed beyond normal network traffic reaching the CAKE-managed path.\nS:U - Impact is confined to kernel traffic-shaping code and warning/panic handling within the affected host; it does not cross VM, container, IOMMU, or other security-authority boundaries.\nC:L - Each WARN_ON(1) emits a kernel backtrace that can disclose kernel text and module pointers via dmesg/syslog to the attacker, constituting limited information disclosure even though no out-of-bounds read or use-after-free occurs.\nI:N - The failure path only executes continue and skips the malformed queued packet; there is no memory corruption, type confusion, or attacker-controlled modification of kernel or network data beyond normal ACK-filter drop behavior.\nA:H - Each matching malformed packet triggers WARN_ON(1) in cake_ack_filter(), flooding kernel warnings and, when panic_on_warn is enabled, invoking check_panic_on_warn() to kernel panic, yielding repeatable denial of service on CAKE-managed router and gateway paths."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/sched/sch_cake.c"], "versions": [{"version": "8b7138814f29933898ecd31dfc83e35a30ee69f5", "lessThan": "c1693b7844a6c06d31a565e5a494948034dfd235", "status": "affected", "versionType": "git"}, {"version": "8b7138814f29933898ecd31dfc83e35a30ee69f5", "lessThan": "a4b52612004a5639c4bfc30ba93ba414b8326e2a", "status": "affected", "versionType": "git"}, {"version": "8b7138814f29933898ecd31dfc83e35a30ee69f5", "lessThan": "ae1b2f8e21a41e7c7e75511bea0c4ccc59ec1bd3", "status": "affected", "versionType": "git"}, {"version": "8b7138814f29933898ecd31dfc83e35a30ee69f5", "lessThan": "0c4882bff34558d8d53fb04c3e96da5c327c7dc8", "status": "affected", "versionType": "git"}, {"version": "8b7138814f29933898ecd31dfc83e35a30ee69f5", "lessThan": "2504a76e5c0694e14e15562730e1339f2d9f9458", "status": "affected", "versionType": "git"}, {"version": "8b7138814f29933898ecd31dfc83e35a30ee69f5", "lessThan": "cd2f1d9fe8a507c2dc86ad326fe221f121c47734", "status": "affected", "versionType": "git"}, {"version": "8b7138814f29933898ecd31dfc83e35a30ee69f5", "lessThan": "a1ae353d8355407c1bea971d1c1af5e7f242bb7d", "status": "affected", "versionType": "git"}, {"version": "8b7138814f29933898ecd31dfc83e35a30ee69f5", "lessThan": "2a33516f9ef59ad11844d4fc152f889449b5daf3", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/sched/sch_cake.c"], "versions": [{"version": "4.19", "status": "affected"}, {"version": "0", "lessThan": "4.19", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.265", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.216", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.183", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.152", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.104", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.45", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.9", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "5.10.265"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "5.15.216"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.1.183"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.6.152"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.12.104"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.18.45"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "7.1.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/c1693b7844a6c06d31a565e5a494948034dfd235"}, {"url": "https://git.kernel.org/stable/c/a4b52612004a5639c4bfc30ba93ba414b8326e2a"}, {"url": "https://git.kernel.org/stable/c/ae1b2f8e21a41e7c7e75511bea0c4ccc59ec1bd3"}, {"url": "https://git.kernel.org/stable/c/0c4882bff34558d8d53fb04c3e96da5c327c7dc8"}, {"url": "https://git.kernel.org/stable/c/2504a76e5c0694e14e15562730e1339f2d9f9458"}, {"url": "https://git.kernel.org/stable/c/cd2f1d9fe8a507c2dc86ad326fe221f121c47734"}, {"url": "https://git.kernel.org/stable/c/a1ae353d8355407c1bea971d1c1af5e7f242bb7d"}, {"url": "https://git.kernel.org/stable/c/2a33516f9ef59ad11844d4fc152f889449b5daf3"}], "title": "net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/sched/sch_cake.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "c1693b7844a6c06d31a565e5a494948034dfd235", "status": "affected", "version": "8b7138814f29933898ecd31dfc83e35a30ee69f5", "versionType": "git"}, {"lessThan": "a4b52612004a5639c4bfc30ba93ba414b8326e2a", "status": "affected", "version": "8b7138814f29933898ecd31dfc83e35a30ee69f5", "versionType": "git"}, {"lessThan": "ae1b2f8e21a41e7c7e75511bea0c4ccc59ec1bd3", "status": "affected", "version": "8b7138814f29933898ecd31dfc83e35a30ee69f5", "versionType": "git"}, {"lessThan": "0c4882bff34558d8d53fb04c3e96da5c327c7dc8", "status": "affected", "version": "8b7138814f29933898ecd31dfc83e35a30ee69f5", "versionType": "git"}, {"lessThan": "2504a76e5c0694e14e15562730e1339f2d9f9458", "status": "affected", "version": "8b7138814f29933898ecd31dfc83e35a30ee69f5", "versionType": "git"}, {"lessThan": "cd2f1d9fe8a507c2dc86ad326fe221f121c47734", "status": "affected", "version": "8b7138814f29933898ecd31dfc83e35a30ee69f5", "versionType": "git"}, {"lessThan": "a1ae353d8355407c1bea971d1c1af5e7f242bb7d", "status": "affected", "version": "8b7138814f29933898ecd31dfc83e35a30ee69f5", "versionType": "git"}, {"lessThan": "2a33516f9ef59ad11844d4fc152f889449b5daf3", "status": "affected", "version": "8b7138814f29933898ecd31dfc83e35a30ee69f5", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/sched/sch_cake.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.19"}, {"lessThan": "4.19", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.265", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.216", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.183", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.152", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.104", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.45", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter\n\nThe sch_cake ACK filter parses packets to find the TCP header and filter\nduplicated ACKs if the flow is backlogged. The parsing code contains a\nWARN_ON(1) which can be triggered by a malformed IP header in certain\ncases. Depending on the system configuration, this leads either to\neither spamming dmesg with warnings, or a panic if panic_on_warn is set.\n\nThe code already correctly skips the offending packet in the branch that\ntriggers the warning, so the WARN_ON itself doesn't really serve any\npurpose. So just drop it altogether to avoid the inconvenient side\neffects."}], "id": "CVE-2026-74704", "lastModified": "2026-08-25T06:18:54.583", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 4.2, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-08-22T16:16:45.090", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0c4882bff34558d8d53fb04c3e96da5c327c7dc8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2504a76e5c0694e14e15562730e1339f2d9f9458"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2a33516f9ef59ad11844d4fc152f889449b5daf3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a1ae353d8355407c1bea971d1c1af5e7f242bb7d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a4b52612004a5639c4bfc30ba93ba414b8326e2a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ae1b2f8e21a41e7c7e75511bea0c4ccc59ec1bd3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c1693b7844a6c06d31a565e5a494948034dfd235"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/cd2f1d9fe8a507c2dc86ad326fe221f121c47734"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter", "id": "2521452", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2521452"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-617", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnet/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter\nThe sch_cake ACK filter parses packets to find the TCP header and filter\nduplicated ACKs if the flow is backlogged. The parsing code contains a\nWARN_ON(1) which can be triggered by a malformed IP header in certain\ncases. Depending on the system configuration, this leads either to\neither spamming dmesg with warnings, or a panic if panic_on_warn is set.\nThe code already correctly skips the offending packet in the branch that\ntriggers the warning, so the WARN_ON itself doesn't really serve any\npurpose. So just drop it altogether to avoid the inconvenient side\neffects.", "A flaw was found in the Linux kernel. The sch_cake ACK filter, responsible for processing network packets, contains a vulnerability. A remote attacker could send specially crafted malformed IP packets. This could lead to the system logging excessive warnings or, under specific configurations, cause a system crash, resulting in a Denial of Service (DoS)."], "name": "CVE-2026-74704", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-22T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-74704\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74704\nhttps://lore.kernel.org/linux-cve-announce/2026082236-CVE-2026-74704-ab92@gregkh/T"], "threat_severity": "Moderate"}