CVE-2026-23398

Home/CVE/In the Linux kernel, the following vulnerability has been resolved: icmp: fix NULL pointer dereference in icmp_tag_vali

CVE

↯ PDF report Light Dark

In the Linux kernel, the following vulnerability has been resolved: icmp: fix NULL pointer dereference in icmp_tag_vali

In the Linux kernel, the following vulnerability has been resolved: icmp: fix NULL pointer dereference in icmp_tag_validation() unconditionally dereferences the result of rcu_dereference(inet_protos[proto]) without checking for NULL. The inet_protos[] array is sparse -- only about 15 of 256 protocol numbers have registered handlers. When ip_no_pmtu_disc is set to 3 (hardened PMTU mode) and the kernel receives an ICMP Fragmentation Needed error with a quoted inner IP header containing an unregistered protocol number, the NULL dereference causes a kernel panic in softirq context.

Oops: general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] RIP: 0010:icmp_unreach (net/ipv4/icmp.c:1085 net/ipv4/icmp.c:1143) Call Trace: <IRQ> icmp_rcv (net/ipv4/icmp.c:1527) ip_protocol_deliver_rcu (net/ipv4/ip_input.c:207) ip_local_deliver_finish (net/ipv4/ip_input.c:242) ip_local_deliver (net/ipv4/ip_input.c:262) ip_rcv (net/ipv4/ip_input.c:573) __netif_receive_skb_one_core (net/core/dev.c:6164) process_backlog (net/core/dev.c:6628) handle_softirqs (kernel/softirq.c:561) </IRQ> Add a NULL check before accessing icmp_strict_tag_validation. If the protocol has no registered handler, return false since it cannot perform strict tag validation.

MEDIUM · CVSS 5.5 EPSS 0.00031

EPSS exploitation odds0.03% · top 90%

Monitor

No active-exploitation, high-EPSS, or public-exploit signals - routine patching cadence

No Sigma yet — build one → YARA rules0

Look this up elsewhere - one-click external pivots

NVD CVE.org CISA Exploit-DB GitHub PoC VulnCheck KEV GreyNoise

▸ How to read a CVE - triage first, then detect and patch

This page is every public fact about CVE-2026-23398, cross-linked. Its job is to answer one question fast - does this need my attention now? - and then hand you the two things you do about it. Here is how an analyst reads it.

Triage: should I act now? Four signals, and they are not interchangeable:

CVSSseverity - how bad it is IF exploited, 0-10. A high CVSS alone is not urgency; a flaw can be a perfect 10 and never actually be attacked. EPSSprobability - a model’s estimate of the chance it is exploited in the next 30 days, 0-1. This is the “will it actually happen” signal. CISA KEVconfirmed - it is being exploited in the wild right now. The strongest signal on the page; KEV beats any score. Weaponisedavailability - public exploits / PoCs, and especially Metasploit modules rated Excellent / Great. Reliable, packaged exploit code means low-skill attackers can use it today.

How they combine: KEV, or a dependable Metasploit module, means patch now regardless of CVSS. High CVSS + low EPSS + no exploit is real but not an emergency - schedule it. Low CVSS but KEV-listed still gets patched now. The verdict above already weighed these for you; this is how it got there.

Then what - two workflows:

Detectwhen you cannot patch today, follow this CVE to the ATT&CK techniques it enables, then Build a SIEM detection (the green button) - author a rule, test it in Atomic, deploy it. That buys visibility while the patch waits. PatchAffected products / packages tell you if you are exposed; Fixed versions by distribution and Vendor advisories give the exact version that closes it.

Reading order for the panels below: verdict + badges, then Public exploits / Metasploit (is it weaponised), then ATT&CK techniques + Sigma / IDS rules (can I detect it), then Affected products / packages + Fixed versions (am I exposed, what patches it), then Threat actors / IOCs (who uses it), then Scoring & timeline / references (the evidence).

▣

Severity & exploitation scoring

View on NVD →

CVSS base score

5.5

MEDIUMCVSS v3.1 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67

EPSS exploitation probability

0.03%

Top 90%odds of exploitation in the next 30 days

CVSS metric silhouette

shape grows toward worst-case

CVSS vector breakdown

Exploitability - how they get in

Attack Vector

Network Adjacent Local Physical

Attack Complexity

Low High

Privileges Required

None Low High

User Interaction

None Required

Scope

Unchanged Changed

Impact - what breaks

Confidentiality

None Low High

Integrity

None Low High

Availability

None Low High

VECTORCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Lifecycle

26 Mar 2026Published to NVD
24 Apr 2026Last modified

Every entry is a recorded date - NVD publish/modify, CISA KEV add, public exploit disclosure. No inferred events.

View attack path from CVE-2026-23398

◆

ATT&CK techniques

Techniques this CVE enables - linked via CWE → CAPEC → ATT&CK. Pills with a solid outline are named directly in ATT&CK or Nuclei templates (high confidence); the others are linked through weakness mappings.

T1068 · Exploitation for Privilege Escalation

▤ Build a SIEM detection for these techniques

⬡

Weakness Classification

CWE-476NULL Pointer Dereference

▤

Affected Products & Versions

linux kernel>= 3.14.1 and < 5.10.253
linux kernel>= 5.11 and < 5.15.203
linux kernel>= 5.16 and < 6.1.167
linux kernel>= 6.2 and < 6.6.130
linux kernel>= 6.7 and < 6.12.78
linux kernel>= 6.13 and < 6.18.20
linux kernel>= 6.19 and < 6.19.10
linux kernelall versions

▤

Related CVEs

CVEs linked to this one by a shared weakness (CWE) or affected product - joins on data already in the engine, with the reason shown per row. Not a guess.

CVE-1999-0052 IP fragmentation denial of service in FreeBSD allows a remote attacker to cause ... same CWE-476 HIGH CVE-2001-1559 The uipc system calls (uipc_syscalls.c) in OpenBSD 2.9 and 3.0 provide user mode... same CWE-476 MEDIUM CVE-2002-0401 SMB dissector in Ethereal 0.9.3 and earlier allows remote attackers to cause a d... same CWE-476 HIGH CVE-2002-1912 SkyStream EMR5000 1.16 through 1.18 does not drop packets or disable the Etherne... same CWE-476 HIGH CVE-1999-1442 Bug in AMD K6 processor on Linux 2.0.x and 2.1.x kernels allows local users to c... same product CVE-1999-1285 Linux 2.1.132 and earlier allows local users to cause a denial of service (resou... same product CVE-1999-0656 The ugidd RPC interface, by design, allows remote attackers to enumerate valid u... same product CVE-1999-0431 Linux 2.2.3 and earlier allow a remote attacker to perform an IP fragmentation a... same product

⚑

Vendor Advisories

suse-csafSUSE-SU-2026:1668-1
suse-csafSUSE-SU-2026:1661-1
suse-csafSUSE-SU-2026:1643-1
suse-csafSUSE-SU-2026:1573-1
suse-csafSUSE-SU-2026:1575-1
suse-csafopenSUSE-SU-2026:20572-1
suse-csafSUSE-SU-2026:21237-1
suse-csafSUSE-SU-2026:21352-1
suse-csafSUSE-SU-2026:21361-1
suse-csafSUSE-SU-2026:21255-1
suse-csafSUSE-SU-2026:1342-1
suse-csafSUSE-SU-2026:21114-1
suse-csafSUSE-SU-2026:21123-1
msrcCVE-2026-23398

🔗

References & Sources

Source URLs (vendor pages, mailing lists, write-ups). Exploit/PoC links are in their own section above to avoid duplication.

https://git.kernel.org/stable/c/1e4e2f5e48cec0cccaea9815fb9486c084ba41e2Patch

https://git.kernel.org/stable/c/1f9f2c6d4b2a613b7756fc5679c5116ba2ca0161Patch

https://git.kernel.org/stable/c/571d9d7b650f02d1e38c01128817868bceac9eddPatch

https://git.kernel.org/stable/c/614aefe56af8e13331e50220c936fc0689cf5675Patch

https://git.kernel.org/stable/c/9647e99d2a617c355d2b378be0ff6d0e848fd579Patch

https://git.kernel.org/stable/c/b61529c357f1ee4d64836eb142a542d2e7ad67cePatch

https://git.kernel.org/stable/c/d783fa413c702ff0f8f8bea63f862e28eeaf39e3Patch

https://git.kernel.org/stable/c/d938dd5a0ad780c891ea3bc94cae7405f11e618aPatch