{"id":"CVE-2026-72326","title":"net/sched: cake: reject overhead values that underflow length","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: cake: reject overhead values that underflow length\n\nCAKE accepts signed overhead values and stores them in an s16, but the\nadjusted packet length calculation…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= a729b7f0bd5bf4919306556aed614438f5174537 < f511dd7bf6077aa7afbe72914520553fedaacbb4","Linux >= a729b7f0bd5bf4919306556aed614438f5174537 < e1df6cff03aad8c96e55a8b2a991e505c7a3ff6f","Linux >= a729b7f0bd5bf4919306556aed614438f5174537 < 297f459865360b46a887667cbf3aac6a6f013841","Linux >= a729b7f0bd5bf4919306556aed614438f5174537 < 336c1e414fc0e9844d445174e8ada2a7dd8d1c4b","Linux >= a729b7f0bd5bf4919306556aed614438f5174537 < bcdf3a3664f7d2c4e37e155f30f72ef33f041804","Linux >= a729b7f0bd5bf4919306556aed614438f5174537 < 7aa0e64fea778a9e3df73e64da95367ff8ad2ea5","Linux >= a729b7f0bd5bf4919306556aed614438f5174537 < f1e7807df5bf2d42a40266430e9f82f37633cdcf","Linux >= a729b7f0bd5bf4919306556aed614438f5174537 < b7f97cae7ec1b6c3c32843c42be218690d310467","Linux 4.19"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-06T16:54:42.548657Z"},"published":"2026-08-15","updated":"2026-11-06","sourceUpdated":"2026-11-06T16:55:26.003Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-72326","references":[{"url":"https://git.kernel.org/stable/c/f511dd7bf6077aa7afbe72914520553fedaacbb4"},{"url":"https://git.kernel.org/stable/c/e1df6cff03aad8c96e55a8b2a991e505c7a3ff6f"},{"url":"https://git.kernel.org/stable/c/297f459865360b46a887667cbf3aac6a6f013841"},{"url":"https://git.kernel.org/stable/c/336c1e414fc0e9844d445174e8ada2a7dd8d1c4b"},{"url":"https://git.kernel.org/stable/c/bcdf3a3664f7d2c4e37e155f30f72ef33f041804"},{"url":"https://git.kernel.org/stable/c/7aa0e64fea778a9e3df73e64da95367ff8ad2ea5"},{"url":"https://git.kernel.org/stable/c/f1e7807df5bf2d42a40266430e9f82f37633cdcf"},{"url":"https://git.kernel.org/stable/c/b7f97cae7ec1b6c3c32843c42be218690d310467"}],"tags":["cve.org"],"epss":0.0022,"epssPercentile":0.12546,"ingestedAt":"2026-11-06T18:00:12.579Z","slug":"CVE-2026-72326","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: cake: reject overhead values that underflow length\n\nCAKE accepts signed overhead values and stores them in an s16, but the\nadjusted packet length calculation uses unsigned arithmetic.  A negative\neffective length can therefore wrap to a large value.\n\nSuch configurations make rate accounting depend on integer wraparound\nrather than on the packet size userspace intended to model.  A static\nnetlink lower bound is not enough because packets reaching CAKE can be\nsmaller than any reasonable manual-overhead allowance.\n\nFold the signed overhead adjustment into the existing datapath MPU clamp\nso negative adjusted lengths are clamped before link-layer framing\nadjustments.\n\n## Affected\n\n- `Linux >= a729b7f0bd5bf4919306556aed614438f5174537 < f511dd7bf6077aa7afbe72914520553fedaacbb4`\n- `Linux >= a729b7f0bd5bf4919306556aed614438f5174537 < e1df6cff03aad8c96e55a8b2a991e505c7a3ff6f`\n- `Linux >= a729b7f0bd5bf4919306556aed614438f5174537 < 297f459865360b46a887667cbf3aac6a6f013841`\n- `Linux >= a729b7f0bd5bf4919306556aed614438f5174537 < 336c1e414fc0e9844d445174e8ada2a7dd8d1c4b`\n- `Linux >= a729b7f0bd5bf4919306556aed614438f5174537 < bcdf3a3664f7d2c4e37e155f30f72ef33f041804`\n- `Linux >= a729b7f0bd5bf4919306556aed614438f5174537 < 7aa0e64fea778a9e3df73e64da95367ff8ad2ea5`\n- `Linux >= a729b7f0bd5bf4919306556aed614438f5174537 < f1e7807df5bf2d42a40266430e9f82f37633cdcf`\n- `Linux >= a729b7f0bd5bf4919306556aed614438f5174537 < b7f97cae7ec1b6c3c32843c42be218690d310467`\n- `Linux 4.19`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}