Strix
56.6K

CVE-2026-72326

UnknownEPSS 0.22%

Last modified

CVE-2026-72326 is a vulnerability of currently unknown severity. In the Linux kernel, the following vulnerability has been resolved: net/sched: cake: reject overhead values that underflow length CAKE accepts signed overhead values and stores them in an s16, but the adjusted packet length calculation uses unsigned arithmetic. A negative effective length can therefore wrap to a large value. Such configurations make rate accounting depend on integer wraparound rather than on the packet size userspace intended to model. EPSS estimates a 0.22% chance of exploitation in the next 30 days.

Description

In the Linux kernel, the following vulnerability has been resolved: net/sched: cake: reject overhead values that underflow length CAKE accepts signed overhead values and stores them in an s16, but the adjusted packet length calculation uses unsigned arithmetic. A negative effective length can therefore wrap to a large value. Such configurations make rate accounting depend on integer wraparound rather than on the packet size userspace intended to model. A static netlink lower bound is not enough because packets reaching CAKE can be smaller than any reasonable manual-overhead allowance. Fold the signed overhead adjustment into the existing datapath MPU clamp so negative adjusted lengths are clamped before link-layer framing adjustments.

Metrics

EPSS Probability
0.22%

12.8th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= a729b7f0bd5bf4919306556aed614438f5174537, < f511dd7bf6077aa7afbe72914520553fedaacbb4; >= a729b7f0bd5bf4919306556aed614438f5174537, < e1df6cff03aad8c96e55a8b2a991e505c7a3ff6f; >= a729b7f0bd5bf4919306556aed614438f5174537, < 297f459865360b46a887667cbf3aac6a6f013841; >= a729b7f0bd5bf4919306556aed614438f5174537, < 336c1e414fc0e9844d445174e8ada2a7dd8d1c4b; >= a729b7f0bd5bf4919306556aed614438f5174537, < bcdf3a3664f7d2c4e37e155f30f72ef33f041804; >= a729b7f0bd5bf4919306556aed614438f5174537, < 7aa0e64fea778a9e3df73e64da95367ff8ad2ea5; >= a729b7f0bd5bf4919306556aed614438f5174537, < f1e7807df5bf2d42a40266430e9f82f37633cdcf; >= a729b7f0bd5bf4919306556aed614438f5174537, < b7f97cae7ec1b6c3c32843c42be218690d310467
LinuxLinux4.19

References

Timeline

Published
Last Modified
Status
Received

Frequently Asked Questions

What is CVE-2026-72326?
In the Linux kernel, the following vulnerability has been resolved: net/sched: cake: reject overhead values that underflow length CAKE accepts signed overhead values and stores them in an s16, but the adjusted packet length calculation uses unsigned arithmetic. A negative effective length can therefore wrap to a large value. Such configurations make rate accounting depend on integer wraparound rather than on the packet size userspace intended to model. A static netlink lower bound is not enough because packets reaching CAKE can be smaller than any reasonable manual-overhead allowance. Fold the signed overhead adjustment into the existing datapath MPU clamp so negative adjusted lengths are clamped before link-layer framing adjustments.
How severe is CVE-2026-72326?
Severity scoring for CVE-2026-72326 is pending analysis. The EPSS model estimates a 0.22% probability of exploitation in the next 30 days.
How do I fix CVE-2026-72326?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-72326?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST