# net/sched: act_ct: preserve tc_skb_cb across defragmentation

CVE record · `CVE-2026-72057`

- **Identifiers:** `CVE-2026-72057`
- **State:** Confirmed
- **Severity:** CVSS 8.2 High
- **Critical:** No
- **CNA:** Linux
- **Weakness (CWE):** [CWE-662](https://cwe.mitre.org/data/definitions/662.html)
- **Tags:** [CWE-662](https://agentprime.io/advisories/tag/cwe-662.md)
- **Technologies:** [Linux kernel](https://agentprime.io/advisories/technology/linux-kernel.md)
- **Published:** 15 Aug 2026
- **Updated:** 19 Oct 2026
- **Reviewed by a person:** No

Published by the CVE Program (CNA: Linux) at 15 Aug 2026, 05:52 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

## Affected products, as the CNA wrote them

- Vendor: Linux. Product: Linux.
  - affected: `0d76daf2013ce1da20eab5e26bd81d983e1c18fb to before fb080b6f54835d5d4d11ce3122800e6f0f6689e6` (git)
  - affected: `ec624fe740b416fb68d536b37fb8eef46f90b5c2 to before 67d6b00a54446c008f52cf70fc0c2ad0c712f85d` (git)
  - affected: `ec624fe740b416fb68d536b37fb8eef46f90b5c2 to before 2400c4b05d58834b994500a9eec90a37db44187c` (git)
  - affected: `ec624fe740b416fb68d536b37fb8eef46f90b5c2 to before 5c3ae5f6c7c6de73ea9b6a75154fe4ed343e1bac` (git)
  - affected: `ec624fe740b416fb68d536b37fb8eef46f90b5c2 to before b3d835407846134b0d54637c0281b39bebef831d` (git)
  - affected: `ec624fe740b416fb68d536b37fb8eef46f90b5c2 to before f7f45ceb855d9ba1cba594fb3f383255f7013fad` (git)
  - affected: `ec624fe740b416fb68d536b37fb8eef46f90b5c2 to before 9092e15defbe6c7bc241c306093ca9d358a578e7` (git)
  - affected: `5.15.13 to before 5.15.217` (semver)
  - Other versions: unaffected
- Vendor: Linux. Product: Linux.
  - affected: `5.16`
  - unaffected: `before 5.16` (semver)
  - unaffected: `5.15.217 to 5.15.*, inclusive` (semver)
  - unaffected: `6.1.184 to 6.1.*, inclusive` (semver)
  - unaffected: `6.6.145 to 6.6.*, inclusive` (semver)
  - unaffected: `6.12.97 to 6.12.*, inclusive` (semver)
  - unaffected: `6.18.40 to 6.18.*, inclusive` (semver)
  - unaffected: `7.1.5 to 7.1.*, inclusive` (semver)
  - unaffected: `7.2 to *, inclusive` (original_commit_for_fix)
  - Other versions: affected

## Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

## Severity and exploitation

- 8.2 High, CVSS 3.1: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H`, from CNA (Linux)

- **CISA KEV:** Not listed.
- **EPSS:** 0.0059, the 48th percentile, on 6 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

## Timeline

This record came from the full history of the CVE Program, published 15 Aug 2026. New records show when each source confirmed them.

## Sources

- [CVE List: CVE-2026-72057](https://www.cve.org/CVERecord?id=CVE-2026-72057)
- [NVD: CVE-2026-72057](https://nvd.nist.gov/vuln/detail/CVE-2026-72057)

### References from the CNA

- <https://git.kernel.org/stable/c/fb080b6f54835d5d4d11ce3122800e6f0f6689e6>
- <https://git.kernel.org/stable/c/67d6b00a54446c008f52cf70fc0c2ad0c712f85d>
- <https://git.kernel.org/stable/c/2400c4b05d58834b994500a9eec90a37db44187c>
- <https://git.kernel.org/stable/c/5c3ae5f6c7c6de73ea9b6a75154fe4ed343e1bac>
- <https://git.kernel.org/stable/c/b3d835407846134b0d54637c0281b39bebef831d>
- <https://git.kernel.org/stable/c/f7f45ceb855d9ba1cba594fb3f383255f7013fad>
- <https://git.kernel.org/stable/c/9092e15defbe6c7bc241c306093ca9d358a578e7>

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.

## Check whether this affects you

This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it. Compare the affected versions above with what you run.

- With the agentprime MCP server (<https://api.agentprime.io/mcp>), `get_advisory` returns this record and `search_advisories` finds related ones. Setup: <https://agentprime.io/mcp.md>
- As JSON: <https://api.agentprime.io/v1/advisories/CVE-2026-72057>
- Everything that needs attention now: <https://agentprime.io/advisories/critical.md>

---

The web page: <https://agentprime.io/advisories/CVE-2026-72057/>. Everything for agents: <https://agentprime.io/llms.txt>.