CVE-2026-72057

A flaw was found in the Linux kernel's networking subsystem, specifically within the act_ct module. This vulnerability occurs when the kernel processes fragmented network traffic, failing to correctly preserve essential packet metadata. An attacker could exploit this by sending specially crafted fragmented traffic, which may lead to a loss of network quality of service (QoS) information. In systems configured to panic on warnings, this flaw could result in a system crash, causing a Denial of Service (DoS).

Red Hat has evaluated this vulnerability as having a Moderate severity because exploitation requires an explicit administrative configuration of Traffic Control connection tracking (act_ct) rules and does not cause a system crash under default system settings. While processing fragmented packets across affected interfaces can corrupt queuing discipline control metadata, the resulting warning triggers an operating system panic only if panic_on_warn has been intentionally enabled. Under default configurations in Red Hat Enterprise Linux, the kernel logs the warning without halting execution, significantly restricting the overall blast radius to localized queue metadata inconsistencies.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.