{"uuid": "9b9fb9ed-7bd3-439e-b63d-3dad9a27a46f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-23398", "type": "published-proof-of-concept", "source": "https://t.me/cve0day/361", "content": "CVE-2026-23398\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nicmp: fix NULL pointer dereference in icmptagvalidation()\n\nicmptagvalidation() unconditionally dereferences the result of\nrcudereference(inetprotosproto) without checking for NULL.\nThe inetprotos[] array is sparse -- only about 15 of 256 protocol\nnumbers have registered handlers. When ipnopmtudisc is set to 3\n(hardened PMTU mode) and the kernel receives an ICMP Fragmentation\nNeeded error with a quoted inner IP header containing an unregistered\nprotocol number, the NULL dereference causes a kernel panic in\nsoftirq context.\n\n Oops: general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 #1 SMP KASAN NOPTI\n KASAN: null-ptr-deref in range 0x0000000000000010-0x0000000000000017\n RIP: 0010:icmpunreach (net/ipv4/icmp.c:1085 net/ipv4/icmp.c:1143)\n Call Trace:\n  \n  icmpr...", "creation_timestamp": "2026-08-28T00:00:30.475956Z"}