CVE-2026-72057

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-72057", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-09T03:40:39.903Z", "datePublished": "2026-08-15T05:52:12.873Z", "dateUpdated": "2026-10-19T21:19:25.539Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-23T12:46:36.427Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: act_ct: preserve tc_skb_cb across defragmentation\n\ntcf_ct_handle_fragments() calls nf_ct_handle_fragments() without saving\nand restoring skb->cb. The defrag helper clears IPCB/IP6CB, which aliases\nthe tc_skb_cb/qdisc_skb_cb control buffer. Fragmented traffic through\nact_ct therefore loses qdisc metadata such as pkt_segs and can trigger\nWARN_ON_ONCE() in qdisc_pkt_segs() when panic_on_warn is enabled.\n\nSave and restore the full tc_skb_cb around nf_ct_handle_fragments(),\nmatching the pattern used by ovs_ct_handle_fragments()."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "baseScore": 8.2, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:N - The bug fires in tcf_ct_act() on the packet datapath (sch_handle_ingress/egress \u2192 tc_run \u2192 tcf_classify) when IP fragments arrive; on OVN/Kubernetes/SDN gateways and mlx5 offload nodes with act_ct already installed, a remote peer triggers it by sending fragmented traffic with no local access.\nAC:L - The attacker fully controls fragment boundaries and ordering; nf_ct_handle_fragments() memset of IPCB/IP6CB that aliases tc_skb_cb runs deterministically on each matching fragment through the configured ct action without races or memory-layout dependencies.\nPR:N - Installing act_ct requires CAP_NET_ADMIN, but triggering the bug on an already-configured internet-facing or tenant-facing gateway needs no target credentials; a remote attacker only sends crafted IP fragments, matching CNA precedent for packet-driven act_ct issues (e.g., CVE-2023-52610).\nUI:N - Exploitation requires only attacker-generated fragmented packets reaching a host with act_ct on clsact/ingress; no victim login, mount, or other interactive action is needed.\nS:U - WARN/panic and corrupted qdisc/tc metadata occur entirely within the host kernel security domain; this is not a VM escape, sandbox breakout, or IOMMU boundary bypass.\nC:N - memset(IPCB/IP6CB) zeroes tc_skb_cb/qdisc_skb_cb fields in place without out-of-bounds read or use-after-free; no kernel memory contents are disclosed to the attacker, only skb control-block metadata is clobbered.\nI:L - Clearing pkt_segs, pkt_len, post_ct, and zone corrupts tc/qdisc state consumed by bstats_update, sch_cake/sch_qfq, and cls_flower zone matching, enabling attacker-driven mis-accounting and mis-handling of packets on the affected path.\nA:H - Zeroed pkt_segs makes qdisc_pkt_segs() hit DEBUG_NET_WARN_ON_ONCE when it disagrees with GSO segment count; with panic_on_warn enabled this kernel-panics the host, and the condition is repeatable with sustained fragmented traffic."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/sched/act_ct.c"], "versions": [{"version": "0d76daf2013ce1da20eab5e26bd81d983e1c18fb", "lessThan": "fb080b6f54835d5d4d11ce3122800e6f0f6689e6", "status": "affected", "versionType": "git"}, {"version": "ec624fe740b416fb68d536b37fb8eef46f90b5c2", "lessThan": "67d6b00a54446c008f52cf70fc0c2ad0c712f85d", "status": "affected", "versionType": "git"}, {"version": "ec624fe740b416fb68d536b37fb8eef46f90b5c2", "lessThan": "2400c4b05d58834b994500a9eec90a37db44187c", "status": "affected", "versionType": "git"}, {"version": "ec624fe740b416fb68d536b37fb8eef46f90b5c2", "lessThan": "5c3ae5f6c7c6de73ea9b6a75154fe4ed343e1bac", "status": "affected", "versionType": "git"}, {"version": "ec624fe740b416fb68d536b37fb8eef46f90b5c2", "lessThan": "b3d835407846134b0d54637c0281b39bebef831d", "status": "affected", "versionType": "git"}, {"version": "ec624fe740b416fb68d536b37fb8eef46f90b5c2", "lessThan": "f7f45ceb855d9ba1cba594fb3f383255f7013fad", "status": "affected", "versionType": "git"}, {"version": "ec624fe740b416fb68d536b37fb8eef46f90b5c2", "lessThan": "9092e15defbe6c7bc241c306093ca9d358a578e7", "status": "affected", "versionType": "git"}, {"version": "5.15.13", "lessThan": "5.15.217", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/sched/act_ct.c"], "versions": [{"version": "5.16", "status": "affected"}, {"version": "0", "lessThan": "5.16", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.217", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.184", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.145", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.97", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.40", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.5", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15.13", "versionEndExcluding": "5.15.217"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.1.184"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.6.145"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.12.97"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.18.40"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "7.1.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/fb080b6f54835d5d4d11ce3122800e6f0f6689e6"}, {"url": "https://git.kernel.org/stable/c/67d6b00a54446c008f52cf70fc0c2ad0c712f85d"}, {"url": "https://git.kernel.org/stable/c/2400c4b05d58834b994500a9eec90a37db44187c"}, {"url": "https://git.kernel.org/stable/c/5c3ae5f6c7c6de73ea9b6a75154fe4ed343e1bac"}, {"url": "https://git.kernel.org/stable/c/b3d835407846134b0d54637c0281b39bebef831d"}, {"url": "https://git.kernel.org/stable/c/f7f45ceb855d9ba1cba594fb3f383255f7013fad"}, {"url": "https://git.kernel.org/stable/c/9092e15defbe6c7bc241c306093ca9d358a578e7"}], "title": "net/sched: act_ct: preserve tc_skb_cb across defragmentation", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-72057", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-16T15:51:06.438816Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-662", "description": "CWE-662 Improper Synchronization"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-19T21:19:25.539Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-72057", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-09T03:40:39.903Z", "datePublished": "2026-08-15T05:52:12.873Z", "dateUpdated": "2026-10-19T21:19:25.539Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-23T12:46:36.427Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: act_ct: preserve tc_skb_cb across defragmentation\n\ntcf_ct_handle_fragments() calls nf_ct_handle_fragments() without saving\nand restoring skb->cb. The defrag helper clears IPCB/IP6CB, which aliases\nthe tc_skb_cb/qdisc_skb_cb control buffer. Fragmented traffic through\nact_ct therefore loses qdisc metadata such as pkt_segs and can trigger\nWARN_ON_ONCE() in qdisc_pkt_segs() when panic_on_warn is enabled.\n\nSave and restore the full tc_skb_cb around nf_ct_handle_fragments(),\nmatching the pattern used by ovs_ct_handle_fragments()."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "baseScore": 8.2, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:N - The bug fires in tcf_ct_act() on the packet datapath (sch_handle_ingress/egress \u2192 tc_run \u2192 tcf_classify) when IP fragments arrive; on OVN/Kubernetes/SDN gateways and mlx5 offload nodes with act_ct already installed, a remote peer triggers it by sending fragmented traffic with no local access.\nAC:L - The attacker fully controls fragment boundaries and ordering; nf_ct_handle_fragments() memset of IPCB/IP6CB that aliases tc_skb_cb runs deterministically on each matching fragment through the configured ct action without races or memory-layout dependencies.\nPR:N - Installing act_ct requires CAP_NET_ADMIN, but triggering the bug on an already-configured internet-facing or tenant-facing gateway needs no target credentials; a remote attacker only sends crafted IP fragments, matching CNA precedent for packet-driven act_ct issues (e.g., CVE-2023-52610).\nUI:N - Exploitation requires only attacker-generated fragmented packets reaching a host with act_ct on clsact/ingress; no victim login, mount, or other interactive action is needed.\nS:U - WARN/panic and corrupted qdisc/tc metadata occur entirely within the host kernel security domain; this is not a VM escape, sandbox breakout, or IOMMU boundary bypass.\nC:N - memset(IPCB/IP6CB) zeroes tc_skb_cb/qdisc_skb_cb fields in place without out-of-bounds read or use-after-free; no kernel memory contents are disclosed to the attacker, only skb control-block metadata is clobbered.\nI:L - Clearing pkt_segs, pkt_len, post_ct, and zone corrupts tc/qdisc state consumed by bstats_update, sch_cake/sch_qfq, and cls_flower zone matching, enabling attacker-driven mis-accounting and mis-handling of packets on the affected path.\nA:H - Zeroed pkt_segs makes qdisc_pkt_segs() hit DEBUG_NET_WARN_ON_ONCE when it disagrees with GSO segment count; with panic_on_warn enabled this kernel-panics the host, and the condition is repeatable with sustained fragmented traffic."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/sched/act_ct.c"], "versions": [{"version": "0d76daf2013ce1da20eab5e26bd81d983e1c18fb", "lessThan": "fb080b6f54835d5d4d11ce3122800e6f0f6689e6", "status": "affected", "versionType": "git"}, {"version": "ec624fe740b416fb68d536b37fb8eef46f90b5c2", "lessThan": "67d6b00a54446c008f52cf70fc0c2ad0c712f85d", "status": "affected", "versionType": "git"}, {"version": "ec624fe740b416fb68d536b37fb8eef46f90b5c2", "lessThan": "2400c4b05d58834b994500a9eec90a37db44187c", "status": "affected", "versionType": "git"}, {"version": "ec624fe740b416fb68d536b37fb8eef46f90b5c2", "lessThan": "5c3ae5f6c7c6de73ea9b6a75154fe4ed343e1bac", "status": "affected", "versionType": "git"}, {"version": "ec624fe740b416fb68d536b37fb8eef46f90b5c2", "lessThan": "b3d835407846134b0d54637c0281b39bebef831d", "status": "affected", "versionType": "git"}, {"version": "ec624fe740b416fb68d536b37fb8eef46f90b5c2", "lessThan": "f7f45ceb855d9ba1cba594fb3f383255f7013fad", "status": "affected", "versionType": "git"}, {"version": "ec624fe740b416fb68d536b37fb8eef46f90b5c2", "lessThan": "9092e15defbe6c7bc241c306093ca9d358a578e7", "status": "affected", "versionType": "git"}, {"version": "5.15.13", "lessThan": "5.15.217", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/sched/act_ct.c"], "versions": [{"version": "5.16", "status": "affected"}, {"version": "0", "lessThan": "5.16", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.217", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.184", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.145", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.97", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.40", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.5", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15.13", "versionEndExcluding": "5.15.217"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.1.184"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.6.145"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.12.97"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.18.40"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "7.1.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/fb080b6f54835d5d4d11ce3122800e6f0f6689e6"}, {"url": "https://git.kernel.org/stable/c/67d6b00a54446c008f52cf70fc0c2ad0c712f85d"}, {"url": "https://git.kernel.org/stable/c/2400c4b05d58834b994500a9eec90a37db44187c"}, {"url": "https://git.kernel.org/stable/c/5c3ae5f6c7c6de73ea9b6a75154fe4ed343e1bac"}, {"url": "https://git.kernel.org/stable/c/b3d835407846134b0d54637c0281b39bebef831d"}, {"url": "https://git.kernel.org/stable/c/f7f45ceb855d9ba1cba594fb3f383255f7013fad"}, {"url": "https://git.kernel.org/stable/c/9092e15defbe6c7bc241c306093ca9d358a578e7"}], "title": "net/sched: act_ct: preserve tc_skb_cb across defragmentation", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-72057", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-16T15:51:06.438816Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-662", "description": "CWE-662 Improper Synchronization"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T15:51:07.134Z"}, "title": "CISA ADP Vulnrichment"}]}}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/sched/act_ct.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "fb080b6f54835d5d4d11ce3122800e6f0f6689e6", "status": "affected", "version": "0d76daf2013ce1da20eab5e26bd81d983e1c18fb", "versionType": "git"}, {"lessThan": "67d6b00a54446c008f52cf70fc0c2ad0c712f85d", "status": "affected", "version": "ec624fe740b416fb68d536b37fb8eef46f90b5c2", "versionType": "git"}, {"lessThan": "2400c4b05d58834b994500a9eec90a37db44187c", "status": "affected", "version": "ec624fe740b416fb68d536b37fb8eef46f90b5c2", "versionType": "git"}, {"lessThan": "5c3ae5f6c7c6de73ea9b6a75154fe4ed343e1bac", "status": "affected", "version": "ec624fe740b416fb68d536b37fb8eef46f90b5c2", "versionType": "git"}, {"lessThan": "b3d835407846134b0d54637c0281b39bebef831d", "status": "affected", "version": "ec624fe740b416fb68d536b37fb8eef46f90b5c2", "versionType": "git"}, {"lessThan": "f7f45ceb855d9ba1cba594fb3f383255f7013fad", "status": "affected", "version": "ec624fe740b416fb68d536b37fb8eef46f90b5c2", "versionType": "git"}, {"lessThan": "9092e15defbe6c7bc241c306093ca9d358a578e7", "status": "affected", "version": "ec624fe740b416fb68d536b37fb8eef46f90b5c2", "versionType": "git"}, {"lessThan": "5.15.217", "status": "affected", "version": "5.15.13", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/sched/act_ct.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.16"}, {"lessThan": "5.16", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.217", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.184", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.145", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.97", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.40", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: act_ct: preserve tc_skb_cb across defragmentation\n\ntcf_ct_handle_fragments() calls nf_ct_handle_fragments() without saving\nand restoring skb->cb. The defrag helper clears IPCB/IP6CB, which aliases\nthe tc_skb_cb/qdisc_skb_cb control buffer. Fragmented traffic through\nact_ct therefore loses qdisc metadata such as pkt_segs and can trigger\nWARN_ON_ONCE() in qdisc_pkt_segs() when panic_on_warn is enabled.\n\nSave and restore the full tc_skb_cb around nf_ct_handle_fragments(),\nmatching the pattern used by ovs_ct_handle_fragments()."}], "id": "CVE-2026-72057", "lastModified": "2026-10-19T22:17:24.793", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 4.2, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-72057", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T15:51:06.438816Z", "version": "2.0.3"}}]}, "published": "2026-08-15T06:21:15.153", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2400c4b05d58834b994500a9eec90a37db44187c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5c3ae5f6c7c6de73ea9b6a75154fe4ed343e1bac"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/67d6b00a54446c008f52cf70fc0c2ad0c712f85d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9092e15defbe6c7bc241c306093ca9d358a578e7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b3d835407846134b0d54637c0281b39bebef831d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f7f45ceb855d9ba1cba594fb3f383255f7013fad"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/fb080b6f54835d5d4d11ce3122800e6f0f6689e6"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-662"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: net/sched: act_ct: preserve tc_skb_cb across defragmentation", "id": "2516680", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2516680"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-617", "details": ["A flaw was found in the Linux kernel's networking subsystem, specifically within the `act_ct` module. This vulnerability occurs when the kernel processes fragmented network traffic, failing to correctly preserve essential packet metadata. An attacker could exploit this by sending specially crafted fragmented traffic, which may lead to a loss of network quality of service (QoS) information. In systems configured to panic on warnings, this flaw could result in a system crash, causing a Denial of Service (DoS)."], "name": "CVE-2026-72057", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-72057\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-72057\nhttps://lore.kernel.org/linux-cve-announce/2026081516-CVE-2026-72057-9a24@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ec624fe740b416fb68d536b37fb8eef46f90b5c2,2400c4b05d58834b994500a9eec90a37db44187c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ec624fe740b416fb68d536b37fb8eef46f90b5c2,5c3ae5f6c7c6de73ea9b6a75154fe4ed343e1bac)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ec624fe740b416fb68d536b37fb8eef46f90b5c2,b3d835407846134b0d54637c0281b39bebef831d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ec624fe740b416fb68d536b37fb8eef46f90b5c2,f7f45ceb855d9ba1cba594fb3f383255f7013fad)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ec624fe740b416fb68d536b37fb8eef46f90b5c2,9092e15defbe6c7bc241c306093ca9d358a578e7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "0d76daf2013ce1da20eab5e26bd81d983e1c18fb"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.15.13,5.16)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.16"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,5.16)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.145,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.97,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.40,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.5,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-15T08:45:05.631738+00:00", "updated": "2026-10-23T00:00:16.054899+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}