{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-72326", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-09T03:40:39.919Z", "datePublished": "2026-08-15T05:55:36.811Z", "dateUpdated": "2026-08-17T05:12:32.814Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T05:12:32.814Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: cake: reject overhead values that underflow length\n\nCAKE accepts signed overhead values and stores them in an s16, but the\nadjusted packet length calculation uses unsigned arithmetic. A negative\neffective length can therefore wrap to a large value.\n\nSuch configurations make rate accounting depend on integer wraparound\nrather than on the packet size userspace intended to model. A static\nnetlink lower bound is not enough because packets reaching CAKE can be\nsmaller than any reasonable manual-overhead allowance.\n\nFold the signed overhead adjustment into the existing datapath MPU clamp\nso negative adjusted lengths are clamped before link-layer framing\nadjustments."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/sched/sch_cake.c"], "versions": [{"version": "a729b7f0bd5bf4919306556aed614438f5174537", "lessThan": "f511dd7bf6077aa7afbe72914520553fedaacbb4", "status": "affected", "versionType": "git"}, {"version": "a729b7f0bd5bf4919306556aed614438f5174537", "lessThan": "e1df6cff03aad8c96e55a8b2a991e505c7a3ff6f", "status": "affected", "versionType": "git"}, {"version": "a729b7f0bd5bf4919306556aed614438f5174537", "lessThan": "297f459865360b46a887667cbf3aac6a6f013841", "status": "affected", "versionType": "git"}, {"version": "a729b7f0bd5bf4919306556aed614438f5174537", "lessThan": "336c1e414fc0e9844d445174e8ada2a7dd8d1c4b", "status": "affected", "versionType": "git"}, {"version": "a729b7f0bd5bf4919306556aed614438f5174537", "lessThan": "bcdf3a3664f7d2c4e37e155f30f72ef33f041804", "status": "affected", "versionType": "git"}, {"version": "a729b7f0bd5bf4919306556aed614438f5174537", "lessThan": "7aa0e64fea778a9e3df73e64da95367ff8ad2ea5", "status": "affected", "versionType": "git"}, {"version": "a729b7f0bd5bf4919306556aed614438f5174537", "lessThan": "f1e7807df5bf2d42a40266430e9f82f37633cdcf", "status": "affected", "versionType": "git"}, {"version": "a729b7f0bd5bf4919306556aed614438f5174537", "lessThan": "b7f97cae7ec1b6c3c32843c42be218690d310467", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/sched/sch_cake.c"], "versions": [{"version": "4.19", "status": "affected"}, {"version": "0", "lessThan": "4.19", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.261", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.212", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.178", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.145", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.97", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.40", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.5", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "5.10.261"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "5.15.212"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.1.178"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.6.145"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.12.97"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "6.18.40"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "7.1.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/f511dd7bf6077aa7afbe72914520553fedaacbb4"}, {"url": "https://git.kernel.org/stable/c/e1df6cff03aad8c96e55a8b2a991e505c7a3ff6f"}, {"url": "https://git.kernel.org/stable/c/297f459865360b46a887667cbf3aac6a6f013841"}, {"url": "https://git.kernel.org/stable/c/336c1e414fc0e9844d445174e8ada2a7dd8d1c4b"}, {"url": "https://git.kernel.org/stable/c/bcdf3a3664f7d2c4e37e155f30f72ef33f041804"}, {"url": "https://git.kernel.org/stable/c/7aa0e64fea778a9e3df73e64da95367ff8ad2ea5"}, {"url": "https://git.kernel.org/stable/c/f1e7807df5bf2d42a40266430e9f82f37633cdcf"}, {"url": "https://git.kernel.org/stable/c/b7f97cae7ec1b6c3c32843c42be218690d310467"}], "title": "net/sched: cake: reject overhead values that underflow length", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/sched/sch_cake.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "f511dd7bf6077aa7afbe72914520553fedaacbb4", "status": "affected", "version": "a729b7f0bd5bf4919306556aed614438f5174537", "versionType": "git"}, {"lessThan": "e1df6cff03aad8c96e55a8b2a991e505c7a3ff6f", "status": "affected", "version": "a729b7f0bd5bf4919306556aed614438f5174537", "versionType": "git"}, {"lessThan": "297f459865360b46a887667cbf3aac6a6f013841", "status": "affected", "version": "a729b7f0bd5bf4919306556aed614438f5174537", "versionType": "git"}, {"lessThan": "336c1e414fc0e9844d445174e8ada2a7dd8d1c4b", "status": "affected", "version": "a729b7f0bd5bf4919306556aed614438f5174537", "versionType": "git"}, {"lessThan": "bcdf3a3664f7d2c4e37e155f30f72ef33f041804", "status": "affected", "version": "a729b7f0bd5bf4919306556aed614438f5174537", "versionType": "git"}, {"lessThan": "7aa0e64fea778a9e3df73e64da95367ff8ad2ea5", "status": "affected", "version": "a729b7f0bd5bf4919306556aed614438f5174537", "versionType": "git"}, {"lessThan": "f1e7807df5bf2d42a40266430e9f82f37633cdcf", "status": "affected", "version": "a729b7f0bd5bf4919306556aed614438f5174537", "versionType": "git"}, {"lessThan": "b7f97cae7ec1b6c3c32843c42be218690d310467", "status": "affected", "version": "a729b7f0bd5bf4919306556aed614438f5174537", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/sched/sch_cake.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.19"}, {"lessThan": "4.19", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.261", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.212", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.178", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.145", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.97", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.40", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: cake: reject overhead values that underflow length\n\nCAKE accepts signed overhead values and stores them in an s16, but the\nadjusted packet length calculation uses unsigned arithmetic. A negative\neffective length can therefore wrap to a large value.\n\nSuch configurations make rate accounting depend on integer wraparound\nrather than on the packet size userspace intended to model. A static\nnetlink lower bound is not enough because packets reaching CAKE can be\nsmaller than any reasonable manual-overhead allowance.\n\nFold the signed overhead adjustment into the existing datapath MPU clamp\nso negative adjusted lengths are clamped before link-layer framing\nadjustments."}], "id": "CVE-2026-72326", "lastModified": "2026-08-17T06:18:36.153", "metrics": {}, "published": "2026-08-15T06:22:05.660", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/297f459865360b46a887667cbf3aac6a6f013841"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/336c1e414fc0e9844d445174e8ada2a7dd8d1c4b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7aa0e64fea778a9e3df73e64da95367ff8ad2ea5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b7f97cae7ec1b6c3c32843c42be218690d310467"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/bcdf3a3664f7d2c4e37e155f30f72ef33f041804"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e1df6cff03aad8c96e55a8b2a991e505c7a3ff6f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f1e7807df5bf2d42a40266430e9f82f37633cdcf"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f511dd7bf6077aa7afbe72914520553fedaacbb4"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: net/sched: cake: reject overhead values that underflow length", "id": "2516593", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2516593"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-191", "details": ["A flaw was found in the Linux kernel's CAKE (Common Applications Kept Enhanced) packet scheduler. This vulnerability arises from the incorrect handling of signed overhead values, which can lead to an integer underflow during packet length calculations. A negative effective length can then wrap to a large value, potentially causing inaccurate network traffic accounting and a denial of service (DoS) condition."], "name": "CVE-2026-72326", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-72326\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-72326\nhttps://lore.kernel.org/linux-cve-announce/2026081507-CVE-2026-72326-3a5b@gregkh/T"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a729b7f0bd5bf4919306556aed614438f5174537,f511dd7bf6077aa7afbe72914520553fedaacbb4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a729b7f0bd5bf4919306556aed614438f5174537,e1df6cff03aad8c96e55a8b2a991e505c7a3ff6f)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a729b7f0bd5bf4919306556aed614438f5174537,297f459865360b46a887667cbf3aac6a6f013841)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a729b7f0bd5bf4919306556aed614438f5174537,336c1e414fc0e9844d445174e8ada2a7dd8d1c4b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a729b7f0bd5bf4919306556aed614438f5174537,bcdf3a3664f7d2c4e37e155f30f72ef33f041804)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a729b7f0bd5bf4919306556aed614438f5174537,7aa0e64fea778a9e3df73e64da95367ff8ad2ea5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a729b7f0bd5bf4919306556aed614438f5174537,f1e7807df5bf2d42a40266430e9f82f37633cdcf)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a729b7f0bd5bf4919306556aed614438f5174537,b7f97cae7ec1b6c3c32843c42be218690d310467)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.19"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,4.19)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.10.261,5.11.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.212,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.178,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.145,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.97,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.40,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.5,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2-rc3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-15T10:30:05.217013+00:00", "updated": "2026-08-22T07:00:07.574954+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}