Junglewise Threat Intelligence

CVE-2026-23398: Linux Kernel NULL pointer dereference in icmp_tag_validation

CVE-2026-23398 · Severity: medium · CVSS 5.5 · Published 2026-03-26

Technologies: Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP, Linux Kernel, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP. Vendors: Siemens, Linux.

Executive brief

A vulnerability in the Linux kernel's networking component can cause a system to crash (kernel panic) when processing specific network error messages. This occurs when the system is configured in a 'hardened' network mode and receives a specially crafted ICMP packet containing an unrecognized protocol. An exploit results in a complete denial of service, potentially disrupting operations or industrial processes relying on the affected system.

Technical details

A NULL pointer dereference exists in the icmp_tag_validation() function within the Linux kernel's IPv4 implementation. The vulnerability is triggered when the 'ip_no_pmtu_disc' setting is set to 3 (hardened PMTU mode) and the kernel receives an ICMP 'Fragmentation Needed' error. If the quoted inner IP header of this ICMP packet contains an unregistered protocol number, the kernel attempts to dereference a NULL entry in the 'inet_protos' array without validation. This results in a kernel panic in the softirq context. Patches have been released across multiple stable kernel branches to add the necessary NULL check.

Affected products

  • Linux Linux Kernel All versions prior to the March 2026 patches
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5, V3.1.6

Timeline

  • 2026-03-18: other: Vulnerability reported and patch authored
  • 2026-03-25: patched: Patches committed to stable kernel trees
  • 2026-03-26: disclosed: CVE-2026-23398 published

References

Related threats