---
id: CVE-2026-72057
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net/sched: act_ct: preserve tc_skb_cb across defragmentation

  tcf_ct_handle_fragments() calls nf_ct_handle_fragments() without saving
  and restoring skb->cb
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net/sched: act_ct: preserve tc_skb_cb across defragmentation

  tcf_ct_handle_fragments() calls nf_ct_handle_fragments() without saving
  and restoring skb->cb. The defrag …
severity: high
cvss: 8.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H'
published: '2026-08-15'
updated: '2026-08-23'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-72057'
references:
  - url: 'https://git.kernel.org/stable/c/2400c4b05d58834b994500a9eec90a37db44187c'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/5c3ae5f6c7c6de73ea9b6a75154fe4ed343e1bac'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/67d6b00a54446c008f52cf70fc0c2ad0c712f85d'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/9092e15defbe6c7bc241c306093ca9d358a578e7'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/b3d835407846134b0d54637c0281b39bebef831d'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/f7f45ceb855d9ba1cba594fb3f383255f7013fad'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/fb080b6f54835d5d4d11ce3122800e6f0f6689e6'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
epss: 0.00585
epssPercentile: 0.46689
ingestedAt: '2026-08-23T13:48:07.927Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

net/sched: act_ct: preserve tc_skb_cb across defragmentation

tcf_ct_handle_fragments() calls nf_ct_handle_fragments() without saving
and restoring skb->cb. The defrag helper clears IPCB/IP6CB, which aliases
the tc_skb_cb/qdisc_skb_cb control buffer. Fragmented traffic through
act_ct therefore loses qdisc metadata such as pkt_segs and can trigger
WARN_ON_ONCE() in qdisc_pkt_segs() when panic_on_warn is enabled.

Save and restore the full tc_skb_cb around nf_ct_handle_fragments(),
matching the pattern used by ovs_ct_handle_fragments().

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.