The kernel bug in the act_ct traffic control module causes the packet control buffer, tc_skb_cb, to be lost during defragmentation because nf_ct_handle_fragments() is called without saving and restoring skb->cb. This loss results in missing qdisc metadata such as packet segment counts. When the kernel is built with panic_on_warn enabled, the loss triggers WARN_ON_ONCE in the qdisc_pkt_segs() function, which can lead to a kernel panic. The weakness reflects improper handling of state across a defragmentation boundary, corresponding to CWE‑704 and CWE‑682.

All Linux kernel installations that enable the act_ct qdisc module and process fragmented IP traffic. The correction is present in kernel patches referenced by the commit logs provided in the advisory; no specific version range is listed, so any kernel version following those commits is considered fixed.

The vulnerability is of high severity because it can cause a kernel crash, but its exploitation requires the attacker to craft fragmented IP packets that pass through the act_ct queue. The EPSS score is not available and the issue is not listed in the CISA KEV catalog, suggesting that exploitation may be uncommon but the impact of a successful exploit would be complete denial of service. Official guidance indicates applying the kernel patch is the best mitigation. No exploit code is publicly disclosed, so the estimated likelihood of attack is low to moderate, yet the potential damage warrants immediate action.