CVE-2026-23398: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23398 is a NULL pointer dereference vulnerability in the Linux kernel's icmp_tag_validation() function within the ICMP subsystem. The function unconditionally dereferences the result of rcu_dereference(inet_protos[proto]) without checking for NULL, which can trigger a kernel panic when processing crafted ICMP Fragmentation Needed packets. It affects Linux kernel versions from 3.14 through multiple stable branches, including 5.10.x (before 5.10.253), 5.15.x (before 5.15.203), 6.1.x (before 6.1.167), 6.6.x (before 6.6.130), 6.12.x (before 6.12.78), 6.13.x through 6.18.x, 6.19.x (before 6.19.10), and 7.0 release candidates. Disclosed on March 26, 2026, it carries a CVSS v3.1 base score of 5.5 (Medium) (Microsoft MSRC, Feedly).

The root cause is classified as CWE-476 (NULL Pointer Dereference). The inet_protos[] array in the Linux kernel is sparse — only approximately 15 of 256 possible protocol numbers have registered handlers. When ip_no_pmtu_disc is set to 3 (hardened PMTU discovery mode), the kernel's icmp_tag_validation() function is invoked during processing of ICMP Fragmentation Needed (Type 3, Code 4) messages. If the quoted inner IP header in such a message contains an unregistered protocol number, rcu_dereference(inet_protos[proto]) returns NULL, and the subsequent unconditional dereference causes a general protection fault and kernel panic in softirq context. The call trace proceeds through icmp_unreach() → icmp_rcv() → ip_protocol_deliver_rcu() → ip_local_deliver() → ip_rcv(). The fix adds a NULL check before accessing icmp_strict_tag_validation, returning false if no handler is registered (Feedly, Linux Kernel Announce).

Successful exploitation results in an immediate kernel panic and system crash, causing a complete denial of service (DoS) condition. The vulnerability has no confidentiality or integrity impact — only availability is affected. Because the crash occurs in softirq context during network packet processing, a remote attacker with network access to the target system can repeatedly trigger the condition to keep the system unavailable. The vulnerability affects a wide range of Linux kernel deployments, including cloud environments (Microsoft Azure Linux 3 kernel 6.6.126.1-1 is specifically listed as affected) (Feedly).

1. Reconnaissance: Identify target Linux systems running kernel versions in the affected range (3.14 through 6.12.77, 6.13–6.18.19, 6.19.0–6.19.9, or 7.0-rc1 through rc4). Determine if the target has ip_no_pmtu_disc set to 3 (hardened PMTU mode) via network probing or configuration disclosure.
2. Craft malicious ICMP packet: Construct an ICMP Fragmentation Needed (Type 3, Code 4) packet. The packet must contain a quoted inner IP header with a protocol number that has no registered handler in inet_protos[] (i.e., not one of the ~15 registered protocol numbers such as TCP/6, UDP/17, ICMP/1, etc.).
3. Send the packet: Transmit the crafted ICMP packet to the target system from a network-accessible position. No authentication or prior access is required — the packet only needs to reach the target's network stack.
4. Trigger kernel panic: When the target kernel processes the ICMP message with ip_no_pmtu_disc=3, icmp_tag_validation() dereferences the NULL pointer returned for the unregistered protocol, causing a general protection fault and kernel panic, resulting in a system crash and reboot (Feedly, Linux Kernel Announce).

• Network: Unexpected ICMP Type 3 (Destination Unreachable) / Code 4 (Fragmentation Needed) packets arriving at the target host with inner IP headers containing unusual or unregistered protocol numbers (e.g., protocol numbers not in the set: 1/ICMP, 2/IGMP, 4/IP-in-IP, 6/TCP, 17/UDP, 41/IPv6, 47/GRE, 50/ESP, 51/AH, 89/OSPF, 103/PIM, 132/SCTP, etc.).
• Logs: Kernel oops messages in /var/log/kern.log or dmesg output containing general protection fault, KASAN: null-ptr-deref, and a call trace referencing icmp_unreach at net/ipv4/icmp.c:1085 or 1143, and icmp_rcv at net/ipv4/icmp.c:1527.
• System Behavior: Unexpected system reboots or kernel panics, particularly on systems with net.ipv4.ip_no_pmtu_disc=3 configured; repeated crashes correlated with inbound ICMP traffic spikes.

Upgrade the Linux kernel to a patched version: 5.10.253, 5.15.203, 6.1.167, 6.6.130, 6.12.78, 6.18.20, 6.19.10, or 7.0-rc5 or later. Patch commits are available from git.kernel.org for multiple stable branches (Feedly). As a temporary workaround if patching is not immediately feasible: (1) disable hardened PMTU discovery mode by setting net.ipv4.ip_no_pmtu_disc to a value other than 3 (note: this may affect network performance); or (2) restrict inbound ICMP Fragmentation Needed packets at the network perimeter firewall. Distribution-specific updates are available from SUSE (SUSE Advisory), Debian, Amazon Linux 2023, and others (Amazon Linux).

A Medium blog post titled "When ICMP Turns Lethal Again: Deep Dive into CVE-2026-23398" was published in early April 2026, providing a technical analysis of the vulnerability (Medium Blog). A follow-up post describing a PoC approach appeared shortly after (Medium PoC). The vulnerability was also mentioned in Dark Web Informer's daily digest for April 7, 2026. Multiple Linux distributions including SUSE, Debian, and Amazon Linux have issued security advisories and updated packages, indicating broad industry awareness and response.