Linux: Improper Synchronization
CVE-2026-72057 is a high-severity improper synchronization vulnerability in Linux, with a CVSS 3.1 base score of 8.2 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. The record lists versions fb080b6f54835d5d4d11ce3122800e6f0f6689e6, 67d6b00a54446c008f52cf70fc0c2ad0c712f85d, 2400c4b05d58834b994500a9eec90a37db44187c as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.58% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update Linux to fb080b6f54835d5d4d11ce3122800e6f0f6689e6 or 67d6b00a54446c008f52cf70fc0c2ad0c712f85d or 2400c4b05d58834b994500a9eec90a37db44187c or 5c3ae5f6c7c6de73ea9b6a75154fe4ed343e1bac, whichever matches your release line, or a later version.
- Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Linux | Linux | 0d76daf2013ce1da20eab5e26bd81d983e1c18fb up to, but not including, fb080b6f54835d5d4d11ce3122800e6f0f6689e6; ec624fe740b416fb68d536b37fb8eef46f90b5c2 up to, but not including, 67d6b00a54446c008f52cf70fc0c2ad0c712f85d; ec624fe740b416fb68d536b37fb8eef46f90b5c2 up to, but not including, 2400c4b05d58834b994500a9eec90a37db44187c; ec624fe740b416fb68d536b37fb8eef46f90b5c2 up to, but not including, 5c3ae5f6c7c6de73ea9b6a75154fe4ed343e1bac; ec624fe740b416fb68d536b37fb8eef46f90b5c2 up to, but not including, b3d835407846134b0d54637c0281b39bebef831d; ec624fe740b416fb68d536b37fb8eef46f90b5c2 up to, but not including, f7f45ceb855d9ba1cba594fb3f383255f7013fad; ec624fe740b416fb68d536b37fb8eef46f90b5c2 up to, but not including, 9092e15defbe6c7bc241c306093ca9d358a578e7; 5.15.13 up to, but not including, 5.15.217; and 1 more ranges | fb080b6f54835d5d4d11ce3122800e6f0f6689e6, 67d6b00a54446c008f52cf70fc0c2ad0c712f85d, 2400c4b05d58834b994500a9eec90a37db44187c, 5c3ae5f6c7c6de73ea9b6a75154fe4ed343e1bac, b3d835407846134b0d54637c0281b39bebef831d, f7f45ceb855d9ba1cba594fb3f383255f7013fad |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- NetworkCan be exploited remotely over a network, including the internet.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- NoneNo account or login is needed.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- NoneNo data is disclosed.
- Integrity
- LowLimited modification of data is possible.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H. Scored by CNA.
Official description
In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ct: preserve tc_skb_cb across defragmentation tcf_ct_handle_fragments() calls nf_ct_handle_fragments() without saving and restoring skb->cb. The defrag helper clears IPCB/IP6CB, which aliases the tc_skb_cb/qdisc_skb_cb control buffer. Fragmented traffic through act_ct therefore loses qdisc metadata such as pkt_segs and can trigger WARN_ON_ONCE() in qdisc_pkt_segs() when panic_on_warn is enabled. Save and restore the full tc_skb_cb around nf_ct_handle_fragments(), matching the pattern used by ovs_ct_handle_fragments().
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Improper Synchronization
The product utilizes multiple threads, processes, components, or systems to allow temporary access to a shared resource that can only be exclusive to one process at a time, but it does not properly synchronize these actions, which might cause simultaneous accesses of this resource by multiple threads or processes.
How developers prevent this class of flaw
- Use industry standard APIs to synchronize your code.
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: none, automatable: yes, technical impact: partial).
- Record last changed materially (score, affected products, status or references).
References
Other references
- git.kernel.org/stable/c/2400c4b05d58834b994500a9eec90a37db44187c
- git.kernel.org/stable/c/5c3ae5f6c7c6de73ea9b6a75154fe4ed343e1bac
- git.kernel.org/stable/c/67d6b00a54446c008f52cf70fc0c2ad0c712f85d
- git.kernel.org/stable/c/9092e15defbe6c7bc241c306093ca9d358a578e7
- git.kernel.org/stable/c/b3d835407846134b0d54637c0281b39bebef831d
- git.kernel.org/stable/c/f7f45ceb855d9ba1cba594fb3f383255f7013fad
- git.kernel.org/stable/c/fb080b6f54835d5d4d11ce3122800e6f0f6689e6
Recent Improper Synchronization vulnerabilities
- 7.8 High severity
- 8.4 High severity
- 7.1 High severity
- 7.8 High severity
- 7.5 High severity
- 8.8 High severity
Spotted an error? Tell us.