Linux Kernel CVE-2026-72057

The Linux kernel traffic control (tc) subsystem provides the act_ct action (net/sched/act_ct.c) to perform connection tracking on in-flight packets, enabling stateful firewall and NAT semantics within qdisc chains. When fragmented packets are encountered, tcf_ct_handle_fragments() delegates reassembly to the netfilter helper nf_ct_handle_fragments(). That helper resets the IP control block (IPCB for IPv4, IP6CB for IPv6) embedded in skb->cb - a 48-byte per-packet scratch area whose layout is union-aliased at compile time between multiple kernel subsystems. The tc_skb_cb and qdisc_skb_cb structures, including the pkt_segs field consumed by qdisc_pkt_segs(), occupy the same memory. Because act_ct neither saves nor restores this region before calling the defrag helper, all qdisc metadata written upstream is lost for every reassembled fragment. The fix follows the pattern already used by Open vSwitch's ovs_ct_handle_fragments(): snapshot the full tc_skb_cb before calling the netfilter helper and restore it afterward. CWE data is absent, but the root cause class is an unsafe shared memory region (CWE-119 / CWE-667 - improper buffer handling / improper locking of shared resource). Affected CPE: cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* across versions from the introducing commit ec624fe740b416fb68d536b37fb8eef46f90b5c2 through the patched stable releases.