Linux Kernel CVE-2026-72057

Exploitation requires three concurrent conditions: (1) the target system must have tc (traffic control) configured with at least one act_ct action in a qdisc filter rule - this is a non-default operator configuration present on Kubernetes nodes, Linux-based firewalls/NAT gateways, and SDN deployments; (2) the attacker must be able to send fragmented IP (IPv4 or IPv6) traffic that reaches and is processed by the act_ct rule - standard fragmented UDP or ICMP packets suffice; (3) for the highest-severity outcome (kernel panic), the kernel must be running with panic_on_warn=1, which is common in hardened production images but not universal. Without panic_on_warn, the impact is silent qdisc metadata corruption rather than a crash. What limits exploitation: systems without any tc act_ct rules are entirely unaffected regardless of kernel version; systems that filter or drop fragmented packets upstream of tc are unaffected; systems with panic_on_warn=0 do not panic but may experience unpredictable traffic scheduling behavior.

The CVSS 3.1 score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) accurately reflects the network-reachable, unauthenticated trigger path but requires important qualification: exploitation is conditional on the target having tc act_ct configured in its qdisc rules - this is not a default kernel configuration and requires deliberate operator setup (common in container runtimes, SDN, or stateful firewall deployments). The A:H rating is valid only when panic_on_warn=1 is set, which while common in production kernels hardened against cascading failures, is not universal. Without panic_on_warn, the worst-case impact is silent metadata corruption affecting qdisc scheduling correctness (I:L), which may cause traffic anomalies rather than a crash. The EPSS score of 0.21% at the 11th percentile strongly signals that no widespread, automated exploitation tooling exists; the vulnerability is not in CISA KEV. The CVSS signal (high theoretical severity) conflicts meaningfully with the EPSS signal (very low exploitation probability), a pattern consistent with a kernel subsystem bug that requires specific environmental preconditions rather than a broadly exploitable service flaw. This is a genuine priority for operators running Linux-based stateful packet processing with tc act_ct, but not a universal emergency patch.

An attacker with network access to a Linux host that has tc act_ct deployed in a qdisc chain (for example, a Kubernetes node using tc-based network policy or a Linux software firewall) sends a stream of deliberately fragmented UDP or TCP packets toward any listening port. As act_ct attempts to reassemble the fragments, nf_ct_handle_fragments() overwrites the qdisc control buffer. On a host with panic_on_warn=1 - common in hardened production kernels - qdisc_pkt_segs() trips its WARN_ON_ONCE assertion and the kernel panics, causing immediate denial of service. No public exploit code has been identified at time of analysis.