CVE-2026-72057

CVE-2026-72057 is a buffer aliasing flaw in the kernel's act_ct action where nf_ct_handle_fragments() overwrites tc_skb_cb, corrupting the pkt_segs metadata that qdisc subsystems rely on for accurate traffic accounting. The bug manifests in two modes: with panic_on_warn enabled, fragmented traffic through act_ct triggers a WARN_ON and kernel panic; in production configurations without that flag, the corruption is silent — pkt_segs is poisoned on every fragmented packet, feeding incorrect segment counts into qdisc bandwidth calculations with no observable error signal. The fix pattern was already present in the kernel tree — ovs_ct_handle_fragments() saves tc_skb_cb before calling nf_ct_handle_fragments() and restores it after. The act_ct code path either predates that fix or was written without adopting it, representing a failure of pattern propagation rather than a novel vulnerability class. This matters for prioritization: the CVSS 8.2 reflects the panic trigger, but the silent pkt_segs corruption is the more significant production risk because it affects every fragmented packet through act_ct regardless of panic settings, potentially causing subtle accounting errors in traffic shaping that are extremely difficult to trace back to this aliasing issue. Defenders should verify whether act_ct is in use in their forwarding paths (particularly in environments using connection tracking with fragment handling), audit kernel configurations for panic_on_warn (disable it in production if enabled, as it masks rather than fixes the corruption), and monitor qdisc statistics for anomalies in segment counting on paths handling fragmented traffic. The upstream fix applies the ovs_ct save/restore pattern to act_ct. Beyond patching, teams should treat this as a signal that skb->cb aliasing between IP control buffers and tc_skb_cb is a recurring structural hazard — any new code path calling nf_ct_handle_fragments() needs the same protection, and the kernel lacks infrastructure to enforce this automatically.

Reviewed through automated stages and approved by a human before publication.