CVE-2011-1927: The ip_expire function in net/ipv4/ip_fragment.c in the Linux kernel before 2.6.39 does not properly constr...

Security readout for executives and security teams

CVE-2011-1927 is a Linux kernel denial-of-service flaw. Crafted fragmented IPv4 packets can trigger a kernel invalid pointer dereference when timed-out fragments generate an ICMP time-exceeded response. The likely business impact is service disruption, not data theft, based on the provided sources. Exposure is most relevant to systems running Linux kernels before 2.6.39, or vendor kernels without the referenced upstream fix, that process untrusted fragmented IPv4 traffic. The source bundle does not provide affected CPEs, distribution advisories, or product-specific status. Treat this as a legacy Linux availability risk. It is not marked as actively exploited in the provided sources, but remote denial of service against exposed systems can still matter where uptime is critical. Prioritize confirmation on old or unsupported Linux hosts. Mitigation focus: Identify Linux systems running kernels before 2.6.39 or vendor builds lacking the fix.; Upgrade to a vendor-supported kernel containing the referenced upstream correction.; Check distribution advisories for backported fixes because vendor version strings may differ..

Prepared

Jun 24, 2026, 12:34 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.