The vulnerability occurs when the CAKE traffic‑control module accepts signed overhead values and stores them in a signed 16‑bit field while later arithmetic uses unsigned calculations. A negative overhead value can cause the effective packet length to wrap around to a large positive number. This integer sign conversion error (CWE‑191) results in the kernel miscalculating packet sizes for rate‑detection and accounting, potentially allowing a user with CAP_NET_ADMIN to configure CAKE in a way that artificially inflates or deflates perceived traffic volumes.

All Linux kernel releases that include the CAKE traffic‑control module are affected. The flaw is present in the kernel source tree under net/sched/cake.c and can be triggered on any system running a kernel that exposes CAKE configuration via netlink. No specific distribution or version is highlighted, so the issue applies broadly across the Linux kernel ecosystem.

The flaw has a moderate risk for systems where CAKE configuration can be modified by untrusted users. Exploitation requires an attacker to issue a netlink command to set a negative overhead value, which requires CAP_NET_ADMIN. Once set, rate accounting uses the wrapped length, allowing the system to believe packets are larger than intended and to circumvent bandwidth limits or throttling. The CVSS score is 5.5, the EPSS score is less than 1%, and the vulnerability is not listed in the CISA KEV catalog.