The flaw lies in the cake traffic‑control module, where an ACK filtering routine performs a WARN_ON(1) when it encounters a packet with a malformed IP header. The warning is triggered by a malformed TCP header, causing repeated dmesg entries or, if panic_on_warn is enabled, an immediate kernel panic. The kernel correctly discards the offending packet, so the issue mainly manifests as a denial of service through log flooding or crash rather than data exfiltration or privilege escalation.

The vulnerability affects all Linux kernel builds that include the sch_cake module. No precise version range is provided, so any system running a kernel with this module before the patch that removes WARN_ON is potentially vulnerable.

An attacker who can send crafted packets to the affected host can trigger the warning or panic. Exploitation requires network access to the interface using sch_cake. The lack of an EPSS score and its absence from KEV does not diminish the potential impact; systems with panic_on_warn enabled are especially at risk. Because the issue is not a memory corruption vulnerability but a kernel panic trigger, the attack vector is local to the network and does not depend on privileged code execution.