CVE-2026-72057: net/sched: act_ct: preserve tc_skb_cb across defragmentation

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

net/sched: act_ct: preserve tc_skb_cb across defragmentation

tcf_ct_handle_fragments() calls nf_ct_handle_fragments() without saving
and restoring skb->cb. The defrag helper clears IPCB/IP6CB, which aliases
the tc_skb_cb/qdisc_skb_cb control buffer. Fragmented traffic through
act_ct therefore loses qdisc metadata such as pkt_segs and can trigger
WARN_ON_ONCE() in qdisc_pkt_segs() when panic_on_warn is enabled.

Save and restore the full tc_skb_cb around nf_ct_handle_fragments(),
matching the pattern used by ovs_ct_handle_fragments().

The Linux kernel CVE team has assigned CVE-2026-72057 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.16 with commit ec624fe740b416fb68d536b37fb8eef46f90b5c2 and fixed in 6.6.145 with commit 2400c4b05d58834b994500a9eec90a37db44187c
	Issue introduced in 5.16 with commit ec624fe740b416fb68d536b37fb8eef46f90b5c2 and fixed in 6.12.97 with commit 5c3ae5f6c7c6de73ea9b6a75154fe4ed343e1bac
	Issue introduced in 5.16 with commit ec624fe740b416fb68d536b37fb8eef46f90b5c2 and fixed in 6.18.40 with commit b3d835407846134b0d54637c0281b39bebef831d
	Issue introduced in 5.16 with commit ec624fe740b416fb68d536b37fb8eef46f90b5c2 and fixed in 7.1.5 with commit f7f45ceb855d9ba1cba594fb3f383255f7013fad
	Issue introduced in 5.16 with commit ec624fe740b416fb68d536b37fb8eef46f90b5c2 and fixed in 7.2-rc1 with commit 9092e15defbe6c7bc241c306093ca9d358a578e7
	Issue introduced in 5.15.13 with commit 0d76daf2013ce1da20eab5e26bd81d983e1c18fb

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-72057
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/sched/act_ct.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/2400c4b05d58834b994500a9eec90a37db44187c
	https://git.kernel.org/stable/c/5c3ae5f6c7c6de73ea9b6a75154fe4ed343e1bac
	https://git.kernel.org/stable/c/b3d835407846134b0d54637c0281b39bebef831d
	https://git.kernel.org/stable/c/f7f45ceb855d9ba1cba594fb3f383255f7013fad
	https://git.kernel.org/stable/c/9092e15defbe6c7bc241c306093ca9d358a578e7