The flaw stems from an unconditional dereference of a possibly null protocol handler within icmp_tag_validation. When the kernel is configured for hardened Path MTU Discovery (ip_no_pmtu_disc set to 3) and receives an ICMP Fragmentation Needed message that quotes an inner IP header using an unregistered protocol number, the null pointer dereference triggers a kernel panic during softirq processing. This leads to a complete loss of service for the affected host and can be triggered remotely via the network stack.

All Linux kernel releases that include the unpatched icmp_tag_validation implementation are affected, as the defect is part of the standard IPv4 ICMP handling code. No vendor‑specific or version information is provided, so the impact covers the entire Linux kernel ecosystem until the patch is applied.

The vulnerability has a CVSS score of 6.2, indicating moderate severity, and an EPSS score below 1%, implying a low probability of exploitation. It is not listed in the CISA KEV catalog. The attack requires only the ability to send crafted ICMP packets to a host with hardened PMTU enabled, which is a remote network‑based attack vector. Although not considered widely exploited, an attacker who can reach the target could cause a crash and disrupt availability.