CVE-2026-74704: Linux Kernel sch_cake DOS Vulnerability

CVE-2026-74704 Overview

CVE-2026-74704 affects the Linux kernel's net/sched: sch_cake queueing discipline. The ACK filter in sch_cake parses packets to locate the TCP header and drop duplicate ACKs when a flow is backlogged. The parsing routine contains a WARN_ON(1) that triggers when a malformed IP header is processed. On systems configured with panic_on_warn, this warning causes a kernel panic. On other systems, attackers can flood dmesg with warnings. The offending packet is already skipped by the surrounding branch, so the WARN_ON served no protective purpose.

Critical Impact
A remote attacker can send malformed IP packets to a Linux host using the sch_cake qdisc with ACK filtering to trigger kernel warnings or a full panic when panic_on_warn is enabled.

Affected Products

Linux kernel versions containing the sch_cake ACK filter with the WARN_ON(1) code path
Distributions shipping affected mainline and stable kernels prior to the referenced fix commits
Systems using the CAKE (Common Applications Kept Enhanced) qdisc with ACK filtering enabled

Discovery Timeline

2026-08-22 - CVE-2026-74704 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-74704

Vulnerability Analysis

The sch_cake scheduler implements an ACK filter designed to reduce backlog by discarding redundant TCP ACKs. To identify duplicate ACKs, the filter walks the packet buffer, decodes the IP header, and locates the TCP header. When the parser encounters an IP header that does not match expected constraints, execution reaches a code path guarded by WARN_ON(1).

The warning macro emits a full kernel stack trace to dmesg on every hit. On kernels booted with the panic_on_warn sysctl or command-line parameter, the same macro escalates to a full panic. Because the CAKE qdisc processes packets received on the network, a remote attacker able to reach an interface using sch_cake with ACK filtering can trigger the condition by sending crafted IP packets.

The issue is a denial-of-service and log-spam primitive rather than a memory-safety bug. Confidentiality impact is limited to the address and register state exposed by the warning stack trace.

Root Cause

The root cause is a defensive WARN_ON(1) placed on an unreachable-looking branch that is actually reachable via attacker-controlled input. The surrounding logic already skips the malformed packet safely. The fix removes the WARN_ON(1) because the warning serves no diagnostic or protective function and converts recoverable input validation into an operational hazard.

Attack Vector

Exploitation requires no authentication and no user interaction. The attacker sends malformed IP packets toward a Linux host whose ingress or egress interface uses the CAKE qdisc with ACK filtering. Repeated packets flood the kernel log. If panic_on_warn is enabled, a single malformed packet is sufficient to crash the host. The vulnerability is described in prose only; see the referenced patch commits for exact parser locations.

// No verified exploit code is available. Refer to the Linux kernel commits
// listed under External References for the corrected parsing logic in the
// sch_cake ACK filter.

Detection Methods for CVE-2026-74704

Indicators of Compromise

Repeated WARN_ON stack traces in dmesg or /var/log/kern.log referencing sch_cake and the ACK filter code path
Unexpected kernel panics on hosts with panic_on_warn set, correlated with network traffic bursts
Elevated packet drop counters on interfaces using the CAKE qdisc alongside malformed-packet counters on upstream devices

Detection Strategies

Inventory hosts running tc qdisc show output that contains cake with ack-filter enabled to identify exposed systems
Alert on kernel ring buffer messages containing sch_cake combined with WARN or Call Trace signatures
Capture and analyze packets on affected interfaces to identify IP headers with invalid length, version, or option fields

Monitoring Recommendations

Forward kernel logs to a central logging or SIEM platform and build detections for sch_cake warning patterns
Monitor host availability and reboot events on Linux routers, gateways, and hypervisors that use CAKE
Track kernel version and patch status across the fleet to confirm remediation coverage

How to Mitigate CVE-2026-74704

Immediate Actions Required

Apply the vendor-supplied kernel update that removes the WARN_ON(1) from the sch_cake ACK filter parser
Audit all Linux hosts for the panic_on_warn setting and disable it on systems that cannot be patched immediately
Restrict untrusted network traffic to interfaces configured with the CAKE qdisc where feasible

Patch Information

Fixes are available in the mainline and stable Linux kernel trees. Relevant commits include Linux Kernel Commit 0c4882bf, Linux Kernel Commit 2504a76e, Linux Kernel Commit 2a33516f, Linux Kernel Commit a1ae353d, Linux Kernel Commit a4b52612, Linux Kernel Commit ae1b2f8e, Linux Kernel Commit c1693b78, and Linux Kernel Commit cd2f1d9f. Consume the fix through your distribution's kernel updates.

Workarounds

Remove or replace the CAKE qdisc on exposed interfaces using tc qdisc del dev <iface> root until patched kernels are deployed
Disable the ACK filter by re-adding CAKE without the ack-filter option
Ensure panic_on_warn is set to 0 in /proc/sys/kernel/panic_on_warn to prevent panic escalation on affected hosts

bash

# Configuration example: disable panic_on_warn and remove ACK filtering
sysctl -w kernel.panic_on_warn=0
tc qdisc replace dev eth0 root cake bandwidth 100mbit
# Reapply without the 'ack-filter' keyword to disable the vulnerable path