The Linux kernel traffic control module act_ct fails to preserve tc_skb_cb when fragmenting IP packets; the module does not save and restore the packet control buffer during nf_ct_handle_fragments(), causing loss of qdisc metadata. This loss can trigger WARN_ON_ONCE in qdisc_pkt_segs() when panic_on_warn is enabled, potentially resulting in a kernel panic and service disruption.

All Linux kernel installations that load the act_ct qdisc module and process fragmented IP traffic. The vulnerability has been fixed in kernel revisions that contain the commit logs referenced in the advisory; any kernel version after those commits includes the patch.

The CVSS score of 8.2 indicates a high severity, but the EPSS score of less than 1% indicates a very low probability of exploitation. The attack requires crafting fragmented IP packets that pass through the act_ct queue, and no exploits are currently listed in the CISA KEV catalog. A successful exploit would cause a kernel panic, resulting in a denial of service, making the threat high impact but low likelihood under normal conditions.