CVE-2026-72057 (GCVE-0-2026-72057)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:52 – Updated: 2026-08-23 12:46
VLAI
Title
net/sched: act_ct: preserve tc_skb_cb across defragmentation
Summary
In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ct: preserve tc_skb_cb across defragmentation tcf_ct_handle_fragments() calls nf_ct_handle_fragments() without saving and restoring skb->cb. The defrag helper clears IPCB/IP6CB, which aliases the tc_skb_cb/qdisc_skb_cb control buffer. Fragmented traffic through act_ct therefore loses qdisc metadata such as pkt_segs and can trigger WARN_ON_ONCE() in qdisc_pkt_segs() when panic_on_warn is enabled. Save and restore the full tc_skb_cb around nf_ct_handle_fragments(), matching the pattern used by ovs_ct_handle_fragments().
Severity
8.2 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 0d76daf2013ce1da20eab5e26bd81d983e1c18fb , < fb080b6f54835d5d4d11ce3122800e6f0f6689e6 (git)
Affected: ec624fe740b416fb68d536b37fb8eef46f90b5c2 , < 67d6b00a54446c008f52cf70fc0c2ad0c712f85d (git)
Affected: ec624fe740b416fb68d536b37fb8eef46f90b5c2 , < 2400c4b05d58834b994500a9eec90a37db44187c (git)
Affected: ec624fe740b416fb68d536b37fb8eef46f90b5c2 , < 5c3ae5f6c7c6de73ea9b6a75154fe4ed343e1bac (git)
Affected: ec624fe740b416fb68d536b37fb8eef46f90b5c2 , < b3d835407846134b0d54637c0281b39bebef831d (git)
Affected: ec624fe740b416fb68d536b37fb8eef46f90b5c2 , < f7f45ceb855d9ba1cba594fb3f383255f7013fad (git)
Affected: ec624fe740b416fb68d536b37fb8eef46f90b5c2 , < 9092e15defbe6c7bc241c306093ca9d358a578e7 (git)
Affected: 5.15.13 , < 5.15.217 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 5.16
Unaffected: 0 , < 5.16 (semver)
Unaffected: 5.15.217 , ≤ 5.15.* (semver)
Unaffected: 6.1.184 , ≤ 6.1.* (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sched/act_ct.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "fb080b6f54835d5d4d11ce3122800e6f0f6689e6",
              "status": "affected",
              "version": "0d76daf2013ce1da20eab5e26bd81d983e1c18fb",
              "versionType": "git"
            },
            {
              "lessThan": "67d6b00a54446c008f52cf70fc0c2ad0c712f85d",
              "status": "affected",
              "version": "ec624fe740b416fb68d536b37fb8eef46f90b5c2",
              "versionType": "git"
            },
            {
              "lessThan": "2400c4b05d58834b994500a9eec90a37db44187c",
              "status": "affected",
              "version": "ec624fe740b416fb68d536b37fb8eef46f90b5c2",
              "versionType": "git"
            },
            {
              "lessThan": "5c3ae5f6c7c6de73ea9b6a75154fe4ed343e1bac",
              "status": "affected",
              "version": "ec624fe740b416fb68d536b37fb8eef46f90b5c2",
              "versionType": "git"
            },
            {
              "lessThan": "b3d835407846134b0d54637c0281b39bebef831d",
              "status": "affected",
              "version": "ec624fe740b416fb68d536b37fb8eef46f90b5c2",
              "versionType": "git"
            },
            {
              "lessThan": "f7f45ceb855d9ba1cba594fb3f383255f7013fad",
              "status": "affected",
              "version": "ec624fe740b416fb68d536b37fb8eef46f90b5c2",
              "versionType": "git"
            },
            {
              "lessThan": "9092e15defbe6c7bc241c306093ca9d358a578e7",
              "status": "affected",
              "version": "ec624fe740b416fb68d536b37fb8eef46f90b5c2",
              "versionType": "git"
            },
            {
              "lessThan": "5.15.217",
              "status": "affected",
              "version": "5.15.13",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sched/act_ct.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.16"
            },
            {
              "lessThan": "5.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.217",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.184",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.217",
                  "versionStartIncluding": "5.15.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.184",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: act_ct: preserve tc_skb_cb across defragmentation\n\ntcf_ct_handle_fragments() calls nf_ct_handle_fragments() without saving\nand restoring skb-\u003ecb. The defrag helper clears IPCB/IP6CB, which aliases\nthe tc_skb_cb/qdisc_skb_cb control buffer. Fragmented traffic through\nact_ct therefore loses qdisc metadata such as pkt_segs and can trigger\nWARN_ON_ONCE() in qdisc_pkt_segs() when panic_on_warn is enabled.\n\nSave and restore the full tc_skb_cb around nf_ct_handle_fragments(),\nmatching the pattern used by ovs_ct_handle_fragments()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug fires in tcf_ct_act() on the packet datapath (sch_handle_ingress/egress \u2192 tc_run \u2192 tcf_classify) when IP fragments arrive; on OVN/Kubernetes/SDN gateways and mlx5 offload nodes with act_ct already installed, a remote peer triggers it by sending fragmented traffic with no local access.\nAC:L - The attacker fully controls fragment boundaries and ordering; nf_ct_handle_fragments() memset of IPCB/IP6CB that aliases tc_skb_cb runs deterministically on each matching fragment through the configured ct action without races or memory-layout dependencies.\nPR:N - Installing act_ct requires CAP_NET_ADMIN, but triggering the bug on an already-configured internet-facing or tenant-facing gateway needs no target credentials; a remote attacker only sends crafted IP fragments, matching CNA precedent for packet-driven act_ct issues (e.g., CVE-2023-52610).\nUI:N - Exploitation requires only attacker-generated fragmented packets reaching a host with act_ct on clsact/ingress; no victim login, mount, or other interactive action is needed.\nS:U - WARN/panic and corrupted qdisc/tc metadata occur entirely within the host kernel security domain; this is not a VM escape, sandbox breakout, or IOMMU boundary bypass.\nC:N - memset(IPCB/IP6CB) zeroes tc_skb_cb/qdisc_skb_cb fields in place without out-of-bounds read or use-after-free; no kernel memory contents are disclosed to the attacker, only skb control-block metadata is clobbered.\nI:L - Clearing pkt_segs, pkt_len, post_ct, and zone corrupts tc/qdisc state consumed by bstats_update, sch_cake/sch_qfq, and cls_flower zone matching, enabling attacker-driven mis-accounting and mis-handling of packets on the affected path.\nA:H - Zeroed pkt_segs makes qdisc_pkt_segs() hit DEBUG_NET_WARN_ON_ONCE when it disagrees with GSO segment count; with panic_on_warn enabled this kernel-panics the host, and the condition is repeatable with sustained fragmented traffic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-23T12:46:36.427Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/fb080b6f54835d5d4d11ce3122800e6f0f6689e6"
        },
        {
          "url": "https://git.kernel.org/stable/c/67d6b00a54446c008f52cf70fc0c2ad0c712f85d"
        },
        {
          "url": "https://git.kernel.org/stable/c/2400c4b05d58834b994500a9eec90a37db44187c"
        },
        {
          "url": "https://git.kernel.org/stable/c/5c3ae5f6c7c6de73ea9b6a75154fe4ed343e1bac"
        },
        {
          "url": "https://git.kernel.org/stable/c/b3d835407846134b0d54637c0281b39bebef831d"
        },
        {
          "url": "https://git.kernel.org/stable/c/f7f45ceb855d9ba1cba594fb3f383255f7013fad"
        },
        {
          "url": "https://git.kernel.org/stable/c/9092e15defbe6c7bc241c306093ca9d358a578e7"
        }
      ],
      "title": "net/sched: act_ct: preserve tc_skb_cb across defragmentation",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72057",
    "datePublished": "2026-08-15T05:52:12.873Z",
    "dateReserved": "2026-08-09T03:40:39.903Z",
    "dateUpdated": "2026-08-23T12:46:36.427Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-72057",
      "date": "2026-09-22",
      "epss": "0.00585",
      "percentile": "0.4666"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/sched/act_ct.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "fb080b6f54835d5d4d11ce3122800e6f0f6689e6",
                    "status": "affected",
                    "version": "0d76daf2013ce1da20eab5e26bd81d983e1c18fb",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "67d6b00a54446c008f52cf70fc0c2ad0c712f85d",
                    "status": "affected",
                    "version": "ec624fe740b416fb68d536b37fb8eef46f90b5c2",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2400c4b05d58834b994500a9eec90a37db44187c",
                    "status": "affected",
                    "version": "ec624fe740b416fb68d536b37fb8eef46f90b5c2",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5c3ae5f6c7c6de73ea9b6a75154fe4ed343e1bac",
                    "status": "affected",
                    "version": "ec624fe740b416fb68d536b37fb8eef46f90b5c2",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b3d835407846134b0d54637c0281b39bebef831d",
                    "status": "affected",
                    "version": "ec624fe740b416fb68d536b37fb8eef46f90b5c2",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f7f45ceb855d9ba1cba594fb3f383255f7013fad",
                    "status": "affected",
                    "version": "ec624fe740b416fb68d536b37fb8eef46f90b5c2",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "9092e15defbe6c7bc241c306093ca9d358a578e7",
                    "status": "affected",
                    "version": "ec624fe740b416fb68d536b37fb8eef46f90b5c2",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5.15.217",
                    "status": "affected",
                    "version": "5.15.13",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/sched/act_ct.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.16"
                  },
                  {
                    "lessThan": "5.16",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.217",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.184",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.145",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.97",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.40",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: act_ct: preserve tc_skb_cb across defragmentation\n\ntcf_ct_handle_fragments() calls nf_ct_handle_fragments() without saving\nand restoring skb-\u003ecb. The defrag helper clears IPCB/IP6CB, which aliases\nthe tc_skb_cb/qdisc_skb_cb control buffer. Fragmented traffic through\nact_ct therefore loses qdisc metadata such as pkt_segs and can trigger\nWARN_ON_ONCE() in qdisc_pkt_segs() when panic_on_warn is enabled.\n\nSave and restore the full tc_skb_cb around nf_ct_handle_fragments(),\nmatching the pattern used by ovs_ct_handle_fragments()."
          }
        ],
        "id": "CVE-2026-72057",
        "lastModified": "2026-08-23T13:16:38.580",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.2,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 4.2,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-15T06:21:15.153",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/2400c4b05d58834b994500a9eec90a37db44187c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/5c3ae5f6c7c6de73ea9b6a75154fe4ed343e1bac"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/67d6b00a54446c008f52cf70fc0c2ad0c712f85d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/9092e15defbe6c7bc241c306093ca9d358a578e7"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b3d835407846134b0d54637c0281b39bebef831d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f7f45ceb855d9ba1cba594fb3f383255f7013fad"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/fb080b6f54835d5d4d11ce3122800e6f0f6689e6"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-17T19:07:50+00:00",
      "cve": "CVE-2026-72057",
      "id": "CVE-2026-72057",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "232",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net/sched: act_ct: preserve tc_skb_cb across defragmentation",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72057.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T01:30:32Z",
      "cve": "CVE-2026-72057",
      "id": "CVE-2026-72057",
      "initial_release_date": "2026-08-28T01:01:49Z",
      "product_status:known_affected": "271",
      "product_status:known_not_affected": "91",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-72057",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-72057.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.