On the Linux kernel, the act_ct traffic control module fails to preserve the packet control buffer tc_skb_cb while processing fragmented IP packets. The nf_ct_handle_fragments() call clears the skb->cb, which holds important qdisc metadata such as packet segment counts. When act_ct processes fragmented traffic, this metadata loss can trigger a WARN_ON_ONCE in qdisc_pkt_segs() if the kernel is configured with panic_on_warn enabled, potentially causing a kernel panic and system downtime. The underlying weakness involves improper handling of fragmented data (CWE-617) and related errors (CWE-662).

Any Linux kernel that loads the act_ct qdisc module and handles fragmented IP traffic is vulnerable, unless the kernel has been upgraded past the commits that introduce the tc_skb_cb preservation logic. All currently supported distribution kernels that enable act_ct and process fragmented packets are affected. The patch was applied in kernel revisions containing the commit logs referenced in the advisory; kernels before those revisions remain impacted.

The CVSS score of 8.2 classifies the issue as a high‑severity kernel vulnerability, but the EPSS score of less than 1% indicates a very low probability of exploitation in the wild. Successful exploitation would require an attacker to send crafted fragmented IP packets that traverse the act_ct qdisc while panic_on_warn is enabled, leading to a denial of service. No known exploits are listed in CISA’s KEV catalog, and the attack would typically affect the entire system due to a kernel panic, but realistic likelihood remains low under normal operating conditions.