CVE-2026-72057

HighCVSS 8.2/10Last modified Oct 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

net/sched: act_ct: preserve tc_skb_cb across defragmentation

tcf_ct_handle_fragments() calls nf_ct_handle_fragments() without saving and restoring skb->cb. The defrag helper clears IPCB/IP6CB, which aliases the tc_skb_cb/qdisc_skb_cb control buffer. Fragmented traffic through act_ct therefore loses qdisc metadata such as pkt_segs and can trigger WARN_ON_ONCE() in qdisc_pkt_segs() when panic_on_warn is enabled.

Save and restore the full tc_skb_cb around nf_ct_handle_fragments(), matching the pattern used by ovs_ct_handle_fragments().

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Weakness enumeration

CWE-662

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Aug 15, 2026
Last modified
Oct 19, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-72058In the Linux kernel, the following vulnerability has been resolved: net: ixp4xx_hss: fix duplicate HDLC netdev allocation ixp4xx_hss_probeCVE-2026-72059In the Linux kernel, the following vulnerability has been resolved: net: wwan: t7xx: destroy DMA pool on CLDMA late init failure t7xx_cldmCVE-2026-72067.3A security flaw has been discovered in dubydu sqlite-mcp up to 0.1.0. The affected element is the function extract_to_json of the file src/eCVE-2026-72060In the Linux kernel, the following vulnerability has been resolved: net: ethernet: ti: icssg: guard PA stat lookups icssg_ndo_get_stats64(CVE-2026-720618.8In the Linux kernel, the following vulnerability has been resolved: net: sit: require CAP_NET_ADMIN in the device netns for changelink ipiCVE-2026-72062In the Linux kernel, the following vulnerability has been resolved: gpio: mt7621: avoid corruption of shared interrupt trigger state The bCVE-2026-72063In the Linux kernel, the following vulnerability has been resolved: gpio: tegra: do not call pinctrl for GPIO direction tegra_gpio_directiCVE-2026-720649.8In the Linux kernel, the following vulnerability has been resolved: net: mana: Sync page pool RX frags for CPU MANA allocates RX buffers fCVE-2026-720659.8In the Linux kernel, the following vulnerability has been resolved: net: mana: Validate the packet length reported by the NIC Validate theCVE-2026-720667.8In the Linux kernel, the following vulnerability has been resolved: cpu: hotplug: Bound hotplug states sysfs output states_show() adds CPUCVE-2026-720677.8In the Linux kernel, the following vulnerability has been resolved: cpu: hotplug: Preserve per instance callback errors cpuhp_invoke_callbCVE-2026-72068In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Use u64 multiplication in update_rlimit_cpu() update
CVE-2026-72057: High severity, CVSS 8.2 | Vulnix