johanneslks/cve-2026-23398Proof-of-concept exploit for a Linux kernel NULL pointer dereference in icmp_tag_validation(), enabling remote denial-of-service via crafted ICMP packets.
Linux Kernel icmp_tag_validation() NULL Pointer Dereference (Remote DoS)
icmp_tag_validation() in net/ipv4/icmp.c dereferences inet_protos[proto]
without a NULL check. A remote attacker can send a single crafted ICMP
Fragmentation Needed packet with an unregistered inner protocol number to crash
the kernel in softirq context.
Affected: Linux kernel before commits 614aefe56af8 (mainline) / d938dd5a0ad7 (stable 6.12)
sudo python3 poc.py --target <TARGET_IP> # single packet, proto 253
sudo python3 poc.py --target <TARGET_IP> --proto 252 # alternate unregistered proto
sudo python3 poc.py --target <TARGET_IP> --count 5 # repeat
net.ipv4.ip_no_pmtu_disc = 3 (non-default; required for icmp_tag_validation() to be reached)This project is released under the GNU GPLv3.
It is provided for defensive security research, education, and authorized testing. Do not use this code against systems or services without explicit permission from the owner.
Unauthorized use may violate applicable law. The authors do not grant permission to test third-party systems and are not responsible for misuse.
See the LICENSE file for warranty and liability terms.