Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-23398— icmp: fix NULL pointer dereference in icmp_tag_validation()

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于icmp_tag_validation函数无条件解引用空指针，可能导致内核崩溃。

AI Predicted 7.5 Difficulty: Moderate EPSS 0.12% · P2

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux 8ed1dc44d3e9e8387a104b1ae8f92e9a3fbf1b1e< 571d9d7b650f02d1e38c01128817868bceac9edd affected
8ed1dc44d3e9e8387a104b1ae8f92e9a3fbf1b1e< d783fa413c702ff0f8f8bea63f862e28eeaf39e3 affected
8ed1dc44d3e9e8387a104b1ae8f92e9a3fbf1b1e< 1f9f2c6d4b2a613b7756fc5679c5116ba2ca0161 affected
8ed1dc44d3e9e8387a104b1ae8f92e9a3fbf1b1e< b61529c357f1ee4d64836eb142a542d2e7ad67ce affected
8ed1dc44d3e9e8387a104b1ae8f92e9a3fbf1b1e< 9647e99d2a617c355d2b378be0ff6d0e848fd579 affected
8ed1dc44d3e9e8387a104b1ae8f92e9a3fbf1b1e< d938dd5a0ad780c891ea3bc94cae7405f11e618a affected
8ed1dc44d3e9e8387a104b1ae8f92e9a3fbf1b1e< 1e4e2f5e48cec0cccaea9815fb9486c084ba41e2 affected
8ed1dc44d3e9e8387a104b1ae8f92e9a3fbf1b1e< 614aefe56af8e13331e50220c936fc0689cf5675 affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-23398

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
icmp: fix NULL pointer dereference in icmp_tag_validation()
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: icmp: fix NULL pointer dereference in icmp_tag_validation() icmp_tag_validation() unconditionally dereferences the result of rcu_dereference(inet_protos[proto]) without checking for NULL. The inet_protos[] array is sparse -- only about 15 of 256 protocol numbers have registered handlers. When ip_no_pmtu_disc is set to 3 (hardened PMTU mode) and the kernel receives an ICMP Fragmentation Needed error with a quoted inner IP header containing an unregistered protocol number, the NULL dereference causes a kernel panic in softirq context. Oops: general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] RIP: 0010:icmp_unreach (net/ipv4/icmp.c:1085 net/ipv4/icmp.c:1143) Call Trace: <IRQ> icmp_rcv (net/ipv4/icmp.c:1527) ip_protocol_deliver_rcu (net/ipv4/ip_input.c:207) ip_local_deliver_finish (net/ipv4/ip_input.c:242) ip_local_deliver (net/ipv4/ip_input.c:262) ip_rcv (net/ipv4/ip_input.c:573) __netif_receive_skb_one_core (net/core/dev.c:6164) process_backlog (net/core/dev.c:6628) handle_softirqs (kernel/softirq.c:561) </IRQ> Add a NULL check before accessing icmp_strict_tag_validation. If the protocol has no registered handler, return false since it cannot perform strict tag validation.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于icmp_tag_validation函数无条件解引用空指针，可能导致内核崩溃。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 8ed1dc44d3e9e8387a104b1ae8f92e9a3fbf1b1e ~ 571d9d7b650f02d1e38c01128817868bceac9edd -
Linux Linux 3.14 -

II. Public POCs for CVE-2026-23398

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-23398

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-23398 (6)

Same Patch Batch · Linux · 2026-03-26 · 3 CVEs total

CVE-2026-23397 nfnetlink_osf: validate individual option lengths in fingerprints
CVE-2026-23396 wifi: mac80211: fix NULL deref in mesh_matches_local()

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-23398

No comments yet

Leave a comment