Linux - Denial of Service via NULL Pointer Dereference in icmp_tag_validation
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2026-23398. PoCs published by SecureWithUmer, zpol, JohannesLks.
AI-analyzed exploit summary This repository provides a functional proof-of-concept for CVE-2026-23398, a Linux kernel NULL pointer dereference vulnerability in ICMP handling (icmp_tag_validation) triggered by crafted ICMP Fragmentation Needed packets with rare protocol numbers. The PoC includes a lab environment with QEMU/KVM, network namespaces, and vulnerable kernel installation scripts to reproduce the crash.
Description
In the Linux kernel, the following vulnerability has been resolved: icmp: fix NULL pointer dereference in icmp_tag_validation() icmp_tag_validation() unconditionally dereferences the result of rcu_dereference(inet_protos[proto]) without checking for NULL. The inet_protos[] array is sparse -- only about 15 of 256 protocol numbers have registered handlers. When ip_no_pmtu_disc is set to 3 (hardened PMTU mode) and the kernel receives an ICMP Fragmentation Needed error with a quoted inner IP header containing an unregistered protocol number, the NULL dereference causes a kernel panic in softirq context. Oops: general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] RIP: 0010:icmp_unreach (net/ipv4/icmp.c:1085 net/ipv4/icmp.c:1143) Call Trace: <IRQ> icmp_rcv (net/ipv4/icmp.c:1527) ip_protocol_deliver_rcu (net/ipv4/ip_input.c:207) ip_local_deliver_finish (net/ipv4/ip_input.c:242) ip_local_deliver (net/ipv4/ip_input.c:262) ip_rcv (net/ipv4/ip_input.c:573) __netif_receive_skb_one_core (net/core/dev.c:6164) process_backlog (net/core/dev.c:6628) handle_softirqs (kernel/softirq.c:561) </IRQ> Add a NULL check before accessing icmp_strict_tag_validation. If the protocol has no registered handler, return false since it cannot perform strict tag validation.
Exploits (3)
This repository provides a functional proof-of-concept for CVE-2026-23398, a Linux kernel NULL pointer dereference vulnerability in ICMP handling (icmp_tag_validation) triggered by crafted ICMP Fragmentation Needed packets with rare protocol numbers. The PoC includes a lab environment with QEMU/KVM, network namespaces, and vulnerable kernel installation scripts to reproduce the crash.
This repository contains a functional proof-of-concept exploit for CVE-2026-23398, a Linux kernel NULL pointer dereference vulnerability in `icmp_tag_validation()` triggered by a crafted ICMP 'Fragmentation Needed' packet when `net.ipv4.ip_no_pmtu_disc=3`. The PoC includes scripts to set up a vulnerable environment, send the malicious packet, and verify the resulting kernel panic.
This repository contains a functional Python PoC for CVE-2026-23398, a Linux kernel NULL pointer dereference in `icmp_tag_validation()` triggered by a crafted ICMP Fragmentation Needed packet with an unregistered inner protocol number, leading to a remote DoS.
References (10)
Scores
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H