EUVD-2026-64391
GHSA-5x69-69gj-gg3f
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
AC:H reflects that CAKE qdisc must be explicitly configured (non-default); A:H retained because panic_on_warn=1 is a realistic scenario in network appliances.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter
The sch_cake ACK filter parses packets to find the TCP header and filter duplicated ACKs if the flow is backlogged. The parsing code contains a WARN_ON(1) which can be triggered by a malformed IP header in certain cases. Depending on the system configuration, this leads either to either spamming dmesg with warnings, or a panic if panic_on_warn is set.
The code already correctly skips the offending packet in the branch that triggers the warning, so the WARN_ON itself doesn't really serve any purpose. So just drop it altogether to avoid the inconvenient side effects.
AnalysisAI
Remote denial of service in the Linux kernel's CAKE traffic scheduler (sch_cake) allows an unauthenticated network attacker to trigger a kernel panic or persistent warning-log flood by sending malformed IP packets to a system with the CAKE qdisc actively configured. Affected systems running Linux 4.19 through unpatched versions of the 7.x series face kernel panic if the non-default panic_on_warn=1 boot parameter is set, or dmesg flooding otherwise. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The `sch_cake` queuing discipline must be explicitly configured on at least one network interface of the target system - this is a deliberate, non-default traffic shaping configuration typically applied via `tc qdisc add dev <iface> root cake` or equivalent tooling (systemd-networkd, nftables, OpenWrt network configs). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The assigned CVSS 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H) overstates real-world risk on two dimensions. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker on an adjacent network segment - or from the internet if routing permits - sends a stream of crafted packets with malformed IP headers to a Linux host where CAKE is configured as the active qdisc on an ingress or egress interface. Each malformed packet causes the kernel's ACK filter parsing routine to hit the unconditional `WARN_ON(1)` branch, generating a kernel warning message. … |
| Remediation | The primary fix is to upgrade to a patched kernel version for your stable series: 5.10.265, 5.15.216, 6.1.183, 6.6.152, 6.12.104, 7.1.9, 7.2, or 6.18.45; the specific upstream fix commits are referenced at https://git.kernel.org/stable/c/ per the CVE references. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory systems running Linux kernels 4.19 through 7.x with CAKE qdisc actively configured using tools like 'tc qdisc show'. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today