CVE-2026-23398

What it actually does

Unconditional dereference of a NULL result from rcu_dereference(inet_protos[proto]) in icmp_tag_validation() when an ICMP Fragmentation Needed packet quotes an inner IP header using an unregistered protocol number and ip_no_pmtu_disc=3, producing a kernel panic in softirq context.

Why it matters to the business

Unexpected kernel crashes on Linux systems can interrupt services, cause data loss in memory, require reboots, and create unplanned downtime; the issue is reachable under common hardened PMTU settings but carries low remote exploit probability.

How an attack unfolds

An attacker with local access crafts an ICMP Fragmentation Needed packet whose quoted inner IP header specifies an unregistered protocol number; when the kernel is in hardened PMTU mode it reaches icmp_tag_validation() which dereferences the NULL handler entry and panics.

How to fix it

Apply the upstream fix that adds a NULL check before dereferencing the protocol handler; rebuild and deploy the patched kernel; until a fixed kernel is available, avoid setting ip_no_pmtu_disc=3 or restrict local users who can inject ICMP packets.

How to confirm the fix worked

Confirm the patched kernel source contains the added NULL check in icmp_tag_validation(); test by sending an ICMP Fragmentation Needed packet with an unregistered inner protocol while ip_no_pmtu_disc=3 and verify the system no longer panics.

Typical attack path

1. Obtain local execution or packet injection capability on the target host
2. Set ip_no_pmtu_disc=3 or confirm the setting is already active
3. Send a crafted ICMP Fragmentation Needed message referencing an unregistered IP protocol in the inner header
4. Trigger the NULL dereference path inside icmp_unreach during softirq processing

How to detect it

Search kernel logs and dmesg for general protection faults or KASAN null-ptr-deref reports with stack traces containing icmp_unreach, icmp_rcv, and ip_local_deliver; correlate with receipt of ICMP type 3 code 4 packets shortly before the crash.

What your security team should do

• Prioritize patching the Linux kernel once a fixed release is available
• Monitor kernel oops and panic logs for icmp_unreach NULL dereference signatures
• Temporarily avoid hardened PMTU mode (ip_no_pmtu_disc=3) on high-availability systems
• Restrict local user capabilities that allow raw ICMP packet construction