---
id: CVE-2026-72326
title: 'net/sched: cake: reject overhead values that underflow length'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net/sched: cake: reject overhead values that underflow length

  CAKE accepts signed overhead values and stores them in an s16, but the
  adjusted packet length calculation…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= a729b7f0bd5bf4919306556aed614438f5174537 <
    f511dd7bf6077aa7afbe72914520553fedaacbb4
  - >-
    Linux >= a729b7f0bd5bf4919306556aed614438f5174537 <
    e1df6cff03aad8c96e55a8b2a991e505c7a3ff6f
  - >-
    Linux >= a729b7f0bd5bf4919306556aed614438f5174537 <
    297f459865360b46a887667cbf3aac6a6f013841
  - >-
    Linux >= a729b7f0bd5bf4919306556aed614438f5174537 <
    336c1e414fc0e9844d445174e8ada2a7dd8d1c4b
  - >-
    Linux >= a729b7f0bd5bf4919306556aed614438f5174537 <
    bcdf3a3664f7d2c4e37e155f30f72ef33f041804
  - >-
    Linux >= a729b7f0bd5bf4919306556aed614438f5174537 <
    7aa0e64fea778a9e3df73e64da95367ff8ad2ea5
  - >-
    Linux >= a729b7f0bd5bf4919306556aed614438f5174537 <
    f1e7807df5bf2d42a40266430e9f82f37633cdcf
  - >-
    Linux >= a729b7f0bd5bf4919306556aed614438f5174537 <
    b7f97cae7ec1b6c3c32843c42be218690d310467
  - Linux 4.19
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T16:54:42.548657Z'
published: '2026-08-15'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T16:55:26.003Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-72326'
references:
  - url: 'https://git.kernel.org/stable/c/f511dd7bf6077aa7afbe72914520553fedaacbb4'
  - url: 'https://git.kernel.org/stable/c/e1df6cff03aad8c96e55a8b2a991e505c7a3ff6f'
  - url: 'https://git.kernel.org/stable/c/297f459865360b46a887667cbf3aac6a6f013841'
  - url: 'https://git.kernel.org/stable/c/336c1e414fc0e9844d445174e8ada2a7dd8d1c4b'
  - url: 'https://git.kernel.org/stable/c/bcdf3a3664f7d2c4e37e155f30f72ef33f041804'
  - url: 'https://git.kernel.org/stable/c/7aa0e64fea778a9e3df73e64da95367ff8ad2ea5'
  - url: 'https://git.kernel.org/stable/c/f1e7807df5bf2d42a40266430e9f82f37633cdcf'
  - url: 'https://git.kernel.org/stable/c/b7f97cae7ec1b6c3c32843c42be218690d310467'
tags:
  - cve.org
epss: 0.0022
epssPercentile: 0.12546
ingestedAt: '2026-11-06T18:00:12.579Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

net/sched: cake: reject overhead values that underflow length

CAKE accepts signed overhead values and stores them in an s16, but the
adjusted packet length calculation uses unsigned arithmetic.  A negative
effective length can therefore wrap to a large value.

Such configurations make rate accounting depend on integer wraparound
rather than on the packet size userspace intended to model.  A static
netlink lower bound is not enough because packets reaching CAKE can be
smaller than any reasonable manual-overhead allowance.

Fold the signed overhead adjustment into the existing datapath MPU clamp
so negative adjusted lengths are clamped before link-layer framing
adjustments.

## Affected

- `Linux >= a729b7f0bd5bf4919306556aed614438f5174537 < f511dd7bf6077aa7afbe72914520553fedaacbb4`
- `Linux >= a729b7f0bd5bf4919306556aed614438f5174537 < e1df6cff03aad8c96e55a8b2a991e505c7a3ff6f`
- `Linux >= a729b7f0bd5bf4919306556aed614438f5174537 < 297f459865360b46a887667cbf3aac6a6f013841`
- `Linux >= a729b7f0bd5bf4919306556aed614438f5174537 < 336c1e414fc0e9844d445174e8ada2a7dd8d1c4b`
- `Linux >= a729b7f0bd5bf4919306556aed614438f5174537 < bcdf3a3664f7d2c4e37e155f30f72ef33f041804`
- `Linux >= a729b7f0bd5bf4919306556aed614438f5174537 < 7aa0e64fea778a9e3df73e64da95367ff8ad2ea5`
- `Linux >= a729b7f0bd5bf4919306556aed614438f5174537 < f1e7807df5bf2d42a40266430e9f82f37633cdcf`
- `Linux >= a729b7f0bd5bf4919306556aed614438f5174537 < b7f97cae7ec1b6c3c32843c42be218690d310467`
- `Linux 4.19`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.