LiveActive security incident?Get immediate response
CVE Record

CVE-2026-23398: icmp: fix NULL pointer dereference in icmp_tag_validation()

In the Linux kernel, the following vulnerability has been resolved: icmp: fix NULL pointer dereference in icmp_tag_validation() icmp_tag_validation() unconditionally dereferences the result of rcu_dereference(inet_protos[proto]) without checking for NULL. The inet_protos[] array is sparse -- only about 15 of 256 protocol numbers have registered handlers. When ip_no_pmtu_disc is set to 3 (hardened PMTU mode) and the kernel receives an ICMP Fragmentation Needed error with a quoted inner IP header containing an unregistered protocol number, the NULL dereference causes a kernel panic in softirq context. Oops: general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] RIP: 0010:icmp_unreach (net/ipv4/icmp.c:1085 net/ipv4/icmp.c:1143) Call Trace: <IRQ> icmp_rcv (net/ipv4/icmp.c:1527) ip_protocol_deliver_rcu (net/ipv4/ip_input.c:207) ip_local_deliver_finish (net/ipv4/ip_input.c:242) ip_local_deliver (net/ipv4/ip_input.c:262) ip_rcv (net/ipv4/ip_input.c:573) __netif_receive_skb_one_core (net/core/dev.c:6164) process_backlog (net/core/dev.c:6628) handle_softirqs (kernel/softirq.c:561) </IRQ> Add a NULL check before accessing icmp_strict_tag_validation. If the protocol has no registered handler, return false since it cannot perform strict tag validation.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2026-23398 is a Linux kernel crash vulnerability. Under a specific PMTU hardening setting, a crafted-looking ICMP Fragmentation Needed error can make the kernel dereference a NULL protocol handler and panic. The business impact is availability loss, not documented data theft or code execution.

Executive priority

Treat this as a targeted availability risk. Prioritize patching exposed Linux infrastructure, appliances, and Siemens-managed environments, especially where hardened PMTU mode is enabled. It is less urgent than a confirmed code execution or exploited vulnerability, but kernel panic risk justifies planned remediation.

Technical view

The bug is in icmp_tag_validation(), which dereferences rcu_dereference(inet_protos[proto]) without checking for NULL. Because inet_protos[] is sparse, an unregistered protocol in the quoted inner IP header can trigger a NULL pointer dereference when ip_no_pmtu_disc is 3. The upstream fix adds a NULL check and returns false for unregistered protocols.

Likely exposure

Exposure is most relevant for Linux systems using the affected kernel code path with ip_no_pmtu_disc set to hardened mode value 3 and reachable by ICMP error traffic. The bundle also cites Siemens advisories, so embedded or appliance deployments should be checked against vendor guidance.

Exploitation context

The source bundle does not report active exploitation, and KEV is false. The described trigger is network-adjacent or remote ICMP processing, but it depends on a specific kernel configuration path. No public exploit reliability, privilege impact, or weaponized exploitation is established in the supplied sources.

Researcher notes

The decisive condition is the interaction between hardened PMTU mode and sparse inet_protos[] lookup. The supplied record lists no CVSS, CWE, or exploitation evidence. Avoid broad claims beyond denial of service unless vendor advisories add more impact detail.

Mitigation direction

  • Apply vendor-supported Linux kernel updates containing the referenced stable fixes.
  • Review Siemens advisories for affected product-specific updates or compensating guidance.
  • Inventory systems with net.ipv4.ip_no_pmtu_disc set to 3.
  • Prioritize internet-facing, routing, appliance, and embedded Linux systems.
  • For unpatched systems, review PMTU hardening requirements with vendor guidance.

Validation and detection

  • Confirm running kernel versions against Linux vendor security advisories.
  • Check whether net.ipv4.ip_no_pmtu_disc is configured to 3.
  • Verify patched kernels include the icmp_tag_validation NULL check.
  • Map Siemens products against SSA-082556 and SSA-019113.
  • Confirm ICMP handling exposure for externally reachable Linux hosts.
Prepared
Confidence
medium
Sources
12

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-23398 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
1ADP providers
11Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

siemens-SADPADP container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux8ed1dc44d3e9e8387a104b1ae8f92e9a3fbf1b1e, 8ed1dc44d3e9e8387a104b1ae8f92e9a3fbf1b1e, 8ed1dc44d3e9e8387a104b1ae8f92e9a3fbf1b1e, 8ed1dc44d3e9e8387a104b1ae8f92e9a3fbf1b1e, 8ed1dc44d3e9e8387a104b1ae8f92e9a3fbf1b1e, 8ed1dc44d3e9e8387a104b1ae8f92e9a3fbf1b1e, 8ed1dc44d3e9e8387a104b1ae8f92e9a3fbf1b1e, 8ed1dc44d3e9e8387a104b1ae8f92e9a3fbf1b1eunaffected
LinuxLinux3.14, 0, 5.10.253, 5.15.203, 6.1.167, 6.6.130, 6.12.78, 6.18.20, 6.19.10, 7.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.