CVE-2026-74704: net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter
In the Linux kernel, the following vulnerability has been resolved:
net/sched: schcake: drop WARNON(1) for malformed packets in ACK filter
The schcake ACK filter parses packets to find the TCP header and filter duplicated ACKs if the flow is backlogged. The parsing code contains a WARNON(1) which can be triggered by a malformed IP header in certain cases. Depending on the system configuration, this leads either to either spamming dmesg with warnings, or a panic if paniconwarn is set.
The code already correctly skips the offending packet in the branch that triggers the warning, so the WARNON itself doesn't really serve any purpose. So just drop it altogether to avoid the inconvenient side effects.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Apply the kernel change described as: net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter, so malformed packets are dropped and the WARN_ON warning/panic (when panic_on_warn is set) is avoided.
Event History
Frequently Asked Questions
What conditions make a system susceptible to a panic?
The issue is reachable when sch_cake's ACK filter processes a malformed IP header. A kernel panic occurs only if panic_on_warn is enabled; otherwise, triggering the condition can spam dmesg with warnings.
Does processing the malformed packet itself cause incorrect ACK filtering?
The affected parsing branch already skips the offending packet. The reported problem is the unnecessary WARN_ON(1) and its side effects, rather than continued processing of the malformed packet.
What can be done if the fix cannot be applied immediately?
The provided data identifies panic_on_warn as the setting that turns the warning into a panic. Disabling panic-on-warning avoids that specific panic behavior, though malformed packets may still generate repeated dmesg warnings.