In the Linux kernel, the following vulnerability has been resolved:
net/sched: cake: reject overhead values that underflow length
CAKE accepts signed overhead values and stores them in an s16, but the adjusted packet length calculation uses unsigned arithmetic. A negative effective length can therefore wrap to a large value.
Such configurations make rate accounting depend on integer wraparound rather than on the packet size userspace intended to model. A static netlink lower bound is not enough because packets reaching CAKE can be smaller than any reasonable manual-overhead allowance.
Fold the signed overhead adjustment into the existing datapath MPU clamp so negative adjusted lengths are clamped before link-layer framing adjustments.
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade perfUpgrade kernel-toolsUpgrade perf-debuginfoUpgrade kernel-tools-develUpgrade kernel-debuginfoUpgrade python3-perfUpgrade kernel-headersUpgrade kernel-tools-debuginfoUpgrade kernel-develUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-modules-extraUpgrade python3-perf-debuginfoUpgrade bpftool-debuginfoUpgrade bpftoolUpgrade kernel-livepatch-6.1.180-225.360Upgrade kernel-debuginfo-common-x86_64Upgrade kernelUpgrade kernel-modules-extra-common | Sep 1, 2026 | Aug 15, 2026 |
| Debian | — | Upgrade linux | Aug 16, 2026 | Aug 16, 2026 |
| Redhat_linux | — | No solution exists | Aug 20, 2026 | Aug 15, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Aug 27, 2026 | Aug 15, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub