HIGH Introduced in 4.19
sch_cake AckFilter Panic
CVE-2026-74704
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
KernelScan AI7.5HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter The sch_cake ACK filter parses packets to find the TCP header and filter duplicated ACKs if the flow is backlogged. The parsing code contains a WARN_ON(1) which can be triggered by a malformed IP header in certain cases. Depending on the system configuration, this leads either to either spamming dmesg with warnings, or a panic if panic_on_warn is set. The code already correctly skips the offending packet in the branch that triggers the warning, so the WARN_ON itself doesn't really serve any purpose. So just drop it altogether to avoid the inconvenient side effects.
02KernelScan AI Analysis
Risk summary
A malformed IP packet traversing a CAKE qdisc with the optional ACK filter enabled triggers a kernel warning that can cause a system panic when panic_on_warn is set, or flood the kernel log otherwise. Any network attacker who can send packets to an interface using CAKE with ACK filtering can trigger this denial of service. The qdisc must be configured by an administrator, but the triggering packet requires no privileges.
Vulnerability analysis
The CAKE traffic-shaping qdisc includes an optional ACK filter that inspects enqueued packets to identify and remove redundant TCP ACKs. During header parsing, the code reaches a branch for unexpected IP header versions that it believed should never occur, and fires a kernel warning. A crafted packet with a malformed IP header can reach this branch. If the system has panic_on_warn enabled, the warning escalates to a full kernel panic; otherwise it repeatedly spams the kernel log. The fix removes the warning call entirely, since the surrounding code already correctly skips the offending packet and moves on. The vulnerability is reachable from the network: any device with the CAKE qdisc configured and ACK filtering enabled on a network-facing interface can be triggered by an attacker sending a single malformed packet. No privileges are needed to send the packet; only the initial qdisc setup requires administrator access.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.12 | 4.19 | 6.12.104 | 2504a76e5c06 |
| 5.10 | 4.19 | 5.10.265 | c1693b7844a6 |
| 6.1 | 4.19 | 6.1.183 | ae1b2f8e21a4 |
| 6.6 | 4.19 | 6.6.152 | 0c4882bff345 |
| 7.1 | 4.19 | 7.1.9 | a1ae353d8355 |
| mainline | 4.19 | 7.2 | 2a33516f9ef5 |
| 5.15 | 4.19 | 5.15.216 | a4b52612004a |
| 6.18 | 4.19 | 6.18.45 | cd2f1d9fe8a5 |
| cip/4.19 | 4.19 | 4.19.325-cip136 | 4cb41334f7e0 |
| cip/4.19-rt | 4.19 | 4.19.325-cip136-rt50 | 4cb41334f7e0 |
| cip/5.10 | 4.19 | 5.10.268-cip77 | c1693b7844a6 |
| cip/5.10-rt | 4.19 | 5.10.268-cip77-rt34 | c1693b7844a6 |
| cip/6.1 | 4.19 | 6.1.187-cip60 | ae1b2f8e21a4 |
| cip/6.12 | 4.19 | 6.12.104-cip30 | 2504a76e5c06 |