CVE-2026-72057

Received Received - Intake

Linux Kernel tc_skb_cb Loss in act_ct Defragmentation

Publication date: 2026-08-15

Last updated on: 2026-08-23

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ct: preserve tc_skb_cb across defragmentation tcf_ct_handle_fragments() calls nf_ct_handle_fragments() without saving and restoring skb->cb. The defrag helper clears IPCB/IP6CB, which aliases the tc_skb_cb/qdisc_skb_cb control buffer. Fragmented traffic through act_ct therefore loses qdisc metadata such as pkt_segs and can trigger WARN_ON_ONCE() in qdisc_pkt_segs() when panic_on_warn is enabled. Save and restore the full tc_skb_cb around nf_ct_handle_fragments(), matching the pattern used by ovs_ct_handle_fragments().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-23

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72057

EUVD

EUVD-2026-59015

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a loss of network traffic metadata during packet defragmentation in the net/sched act_ct module. When fragmented traffic passes through act_ct, the defragmentation process clears critical control buffer data (tc_skb_cb) that tracks packet segments. This can trigger a kernel warning or crash if panic_on_warn is enabled.

Detection Guidance

This vulnerability involves fragmented traffic through act_ct losing qdisc metadata, which may trigger WARN_ON_ONCE() errors when panic_on_warn is enabled. Detection involves monitoring kernel logs for warnings related to qdisc_pkt_segs() or act_ct. Check kernel logs with: dmesg | grep -i 'qdisc_pkt_segs\|act_ct\|WARN_ON_ONCE'. If warnings appear, the system may be affected.

Impact Analysis

If exploited, this flaw could cause system instability or crashes when processing fragmented network traffic through act_ct. It may lead to denial-of-service conditions or unexpected kernel behavior, particularly on systems with panic_on_warn enabled.

Compliance Impact

This vulnerability does not directly impact compliance with standards like GDPR or HIPAA. It is a Linux kernel issue related to network traffic handling that could cause system instability but does not involve data breaches or unauthorized access.

Mitigation Strategies

Update your Linux kernel to the latest patched version to resolve this vulnerability. Monitor system logs for WARN_ON_ONCE() errors related to qdisc_pkt_segs() which may indicate exploitation attempts.

Hi! I’m here to help you understand CVE-2026-72057. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70