{"affected":[{"defaultStatus":"unaffected","product":"Linux","source":"CNA: Linux","vendor":"Linux","versions":[{"lessThan":"f511dd7bf6077aa7afbe72914520553fedaacbb4","status":"affected","version":"a729b7f0bd5bf4919306556aed614438f5174537","versionType":"git"},{"lessThan":"e1df6cff03aad8c96e55a8b2a991e505c7a3ff6f","status":"affected","version":"a729b7f0bd5bf4919306556aed614438f5174537","versionType":"git"},{"lessThan":"297f459865360b46a887667cbf3aac6a6f013841","status":"affected","version":"a729b7f0bd5bf4919306556aed614438f5174537","versionType":"git"},{"lessThan":"336c1e414fc0e9844d445174e8ada2a7dd8d1c4b","status":"affected","version":"a729b7f0bd5bf4919306556aed614438f5174537","versionType":"git"},{"lessThan":"bcdf3a3664f7d2c4e37e155f30f72ef33f041804","status":"affected","version":"a729b7f0bd5bf4919306556aed614438f5174537","versionType":"git"},{"lessThan":"7aa0e64fea778a9e3df73e64da95367ff8ad2ea5","status":"affected","version":"a729b7f0bd5bf4919306556aed614438f5174537","versionType":"git"},{"lessThan":"f1e7807df5bf2d42a40266430e9f82f37633cdcf","status":"affected","version":"a729b7f0bd5bf4919306556aed614438f5174537","versionType":"git"},{"lessThan":"b7f97cae7ec1b6c3c32843c42be218690d310467","status":"affected","version":"a729b7f0bd5bf4919306556aed614438f5174537","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","source":"CNA: Linux","vendor":"Linux","versions":[{"status":"affected","version":"4.19"},{"lessThan":"4.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.261","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.212","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.178","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.145","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.97","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.40","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.5","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"cveId":"CVE-2026-72326","cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: cake: reject overhead values that underflow length\n\nCAKE accepts signed overhead values and stores them in an s16, but the\nadjusted packet length calculation uses unsigned arithmetic.  A negative\neffective length can therefore wrap to a large value.\n\nSuch configurations make rate accounting depend on integer wraparound\nrather than on the packet size userspace intended to model.  A static\nnetlink lower bound is not enough because packets reaching CAKE can be\nsmaller than any reasonable manual-overhead allowance.\n\nFold the signed overhead adjustment into the existing datapath MPU clamp\nso negative adjusted lengths are clamped before link-layer framing\nadjustments.","epss":{"date":"2026-11-06","percentile":0.12541,"score":0.0022},"exploits":[],"kev":null,"metrics":[],"modifiedAt":1793985583173,"publishedAt":1786773336811,"references":[{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/f511dd7bf6077aa7afbe72914520553fedaacbb4"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/e1df6cff03aad8c96e55a8b2a991e505c7a3ff6f"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/297f459865360b46a887667cbf3aac6a6f013841"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/336c1e414fc0e9844d445174e8ada2a7dd8d1c4b"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/bcdf3a3664f7d2c4e37e155f30f72ef33f041804"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/7aa0e64fea778a9e3df73e64da95367ff8ad2ea5"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/f1e7807df5bf2d42a40266430e9f82f37633cdcf"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/b7f97cae7ec1b6c3c32843c42be218690d310467"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"url":"https://git.kernel.org/stable/c/297f459865360b46a887667cbf3aac6a6f013841"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"url":"https://git.kernel.org/stable/c/336c1e414fc0e9844d445174e8ada2a7dd8d1c4b"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"url":"https://git.kernel.org/stable/c/7aa0e64fea778a9e3df73e64da95367ff8ad2ea5"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"url":"https://git.kernel.org/stable/c/b7f97cae7ec1b6c3c32843c42be218690d310467"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"url":"https://git.kernel.org/stable/c/bcdf3a3664f7d2c4e37e155f30f72ef33f041804"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"url":"https://git.kernel.org/stable/c/e1df6cff03aad8c96e55a8b2a991e505c7a3ff6f"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"url":"https://git.kernel.org/stable/c/f1e7807df5bf2d42a40266430e9f82f37633cdcf"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"url":"https://git.kernel.org/stable/c/f511dd7bf6077aa7afbe72914520553fedaacbb4"}],"remediation":[],"revision":"cbf3de0f78362398cafb54201f503c887a0ca244827576bd4a5a25ba563a8d91","sources":[{"modifiedAt":1793984126003,"name":"CNA: Linux","retrievedAt":1793986095470,"url":"https://www.cve.org/CVERecord?id=CVE-2026-72326"},{"modifiedAt":1793985583173,"name":"NVD","retrievedAt":1793989709461,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72326"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793986123793,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-72326"}],"ssvc":{"assessedAt":1793984082548,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"net/sched: cake: reject overhead values that underflow length","updatedAt":1793989709461}