In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter The… (CVE-2026-74704)
A vulnerability in the Linux kernel's sch_cake ACK filter was resolved by removing a WARN_ON(1) call triggered by malformed IP headers. This warning could cause excessive kernel log messages or a kernel panic if panic_on_warn is enabled. The underlying code already handled the malformed packets correctly by skipping them, so the warning was unnecessary and removed to prevent these side effects.
AI Analysis
Technical Summary
The Linux kernel's sch_cake ACK filter parses TCP packets to identify and filter duplicate ACKs when the flow is backlogged. The parsing code contained a WARN_ON(1) statement that could be triggered by malformed IP headers, leading to either spamming of kernel logs (dmesg) or a kernel panic if the system is configured with panic_on_warn. Since the code already skips the offending packets, the warning was redundant and was removed to avoid these disruptive behaviors.
Potential Impact
Depending on system configuration, this vulnerability could cause denial of service through kernel panics or log flooding. Systems with panic_on_warn enabled may experience kernel panics, leading to system crashes. Systems without this setting may suffer from excessive kernel log messages, potentially obscuring other important logs.
Mitigation Recommendations
A fix has been implemented by removing the unnecessary WARN_ON(1) call in the sch_cake ACK filter code. Users should update their Linux kernel to a version that includes this fix. No additional mitigation is required as the underlying packet handling was already correct.
In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter The… (CVE-2026-74704)
Description
A vulnerability in the Linux kernel's sch_cake ACK filter was resolved by removing a WARN_ON(1) call triggered by malformed IP headers. This warning could cause excessive kernel log messages or a kernel panic if panic_on_warn is enabled. The underlying code already handled the malformed packets correctly by skipping them, so the warning was unnecessary and removed to prevent these side effects.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel's sch_cake ACK filter parses TCP packets to identify and filter duplicate ACKs when the flow is backlogged. The parsing code contained a WARN_ON(1) statement that could be triggered by malformed IP headers, leading to either spamming of kernel logs (dmesg) or a kernel panic if the system is configured with panic_on_warn. Since the code already skips the offending packets, the warning was redundant and was removed to avoid these disruptive behaviors.
Potential Impact
Depending on system configuration, this vulnerability could cause denial of service through kernel panics or log flooding. Systems with panic_on_warn enabled may experience kernel panics, leading to system crashes. Systems without this setting may suffer from excessive kernel log messages, potentially obscuring other important logs.
Mitigation Recommendations
A fix has been implemented by removing the unnecessary WARN_ON(1) call in the sch_cake ACK filter code. Users should update their Linux kernel to a version that includes this fix. No additional mitigation is required as the underlying packet handling was already correct.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-5x69-69gj-gg3f
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-74704"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a8a27f0acd9273b499bc711
Added to database: 08/22/2026, 22:51:28 UTC
Last enriched: 08/23/2026, 00:39:35 UTC
Last updated: 08/23/2026, 02:32:01 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.