CVE-2026-72057 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, network administrators, and security teams responsible for Linux kernel patching and vulnerability management should be aware of this vulnerability. They should review and apply the kernel patch to ensure tc_skb_cb is preserved across defragmentation. Additionally, they should verify and update the Linux kernel to the latest version and monitor for potential WARN_ON_ONCE() triggers in qdisc_pkt_segs(). This vulnerability affects systems using the Linux kernel with the act_ct module, particularly those handling fragmented traffic. Affected operators and platforms should prioritize patching to prevent potential issues. Vulnerability management and security teams should track exceptions, retest remediated assets, and close the item only after evidence is documented. This requires coordination between development, operations, and security teams to ensure timely and effective mitigation. The impacted systems may include various Linux distributions and versions, emphasizing the need for thorough review and timely patching across diverse environments. Security teams should also review compensating controls for exposed systems while remediation is scheduled and verified. Monitoring and detection capabilities should be checked for exposed assets that need extra review. Asset inventory management is crucial to identify and prioritize affected systems for patching. Effective communication and collaboration among teams are essential to address this vulnerability comprehensively. The resolution of this issue underscores the importance of rigorous testing and validation of kernel patches to prevent similar oversights in the future. By addressing this vulnerability, the Linux kernel community demonstrates its commitment to maintaining the security and stability of the kernel. This incident highlights the value of community involvement and transparent disclosure in the open-source development process. Linux distributions and vendors should also be proactive in integrating and deploying this patch to their users. The vulnerability's resolution contributes to the ongoing efforts to enhance the security and resilience of critical software.

Technical summary

The tcf_ct_handle_fragments() function in the Linux kernel's net/sched: act_ct does not save and restore tc_skb_cb around nf_ct_handle_fragments(). This can lead to potential loss of qdisc metadata such as pkt_segs. The vulnerability can trigger WARN_ON_ONCE() in qdisc_pkt_segs() when panic_on_warn is enabled. To address this, the full tc_skb_cb should be saved and restored around nf_ct_handle_fragments(), similar to the approach used by ovs_ct_handle_fragments(). This fix ensures that qdisc metadata is preserved during defragmentation, preventing unexpected warnings and potential issues in packet processing.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the kernel patch to ensure tc_skb_cb is preserved across defragmentation
• Verify and update Linux kernel to the latest version
• Monitor for potential WARN_ON_ONCE() triggers in qdisc_pkt_segs()
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability is related to the Linux kernel's net/sched: act_ct. The tcf_ct_handle_fragments() function calls nf_ct_handle_fragments() without saving and restoring skb->cb. This can lead to lost qdisc metadata such as pkt_segs and can trigger WARN_ON_ONCE() in qdisc_pkt_segs() when panic_on_warn is enabled.

Official resources