CVE-2026-74704

The Linux kernel's traffic‑control scheduler cake (sch_cake) contains an ACK filter that parses incoming packets to locate the TCP header. The parsing code includes a hardcoded WARN_ON(1) that is triggered when a malformed IP header is detected. This is a CWE‑617 weakness involving improper restriction of operations within a buffer. While the function correctly drops the offending packet, the warning itself can either flood the kernel log or, if the system is configured with panic_on_warn enabled, cause an immediate kernel panic. The result is a denial of service manifested as either excessive log noise or a system crash, with no data exfiltration or privilege escalation occurring.

This flaw affects all Linux kernel builds that load the sch_cake module. No specific version range is provided, so any system running a kernel containing the offending code before the patch that removes the WARN_ON is potentially vulnerable. The impact extends to systems that have sch_cake enabled as a qdisc on at least one active network interface.

The likely attack vector is remote network access, where an attacker sends crafted packets with malformed IP/TCP headers to a target host that has sch_cake enabled. Based on the description, it is inferred that such packets can be injected through any network interface using the qdisc. The CVSS score of 8.2 indicates high severity, while the EPSS score of less than 1% suggests a low but non‑zero probability of exploitation. The flaw is not listed in the CISA KEV catalog and does not provide an exploit path beyond triggering a crash or log spam.