CVE-2026-72326

A flaw was found in the Linux kernel's CAKE (Common Applications Kept Enhanced) packet scheduler. This vulnerability arises from the incorrect handling of signed overhead values, which can lead to an integer underflow during packet length calculations. A negative effective length can then wrap to a large value, potentially causing inaccurate network traffic accounting and a denial of service (DoS) condition.

This vulnerability is rated as Low severity because exploiting it requires privileged administrative access (CAP_NET_ADMIN) to configure traffic control queue disciplines, and CAKE is not configured or active by default in standard Red Hat Enterprise Linux deployments. The issue stems from improper handling of negative overhead adjustments within the packet scheduling layer, leading to miscalculated frame dimensions and potential traffic throttling or denial of service. Because standard configurations do not enable this scheduler and exploitation is restricted to privileged local contexts without enabling code execution or privilege escalation, the overall operational risk remains minimal.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.