The flaw stems from an unconditional dereference of a possibly null protocol handler within icmp_tag_validation. When the kernel is configured for hardened Path MTU Discovery (ip_no_pmtu_disc set to 3) and receives an ICMP Fragmentation Needed message that quotes an inner IP header using an unregistered protocol number, the null pointer dereference triggers a kernel panic during softirq processing. This leads to a complete loss of service for the affected host and can be triggered remotely via the network stack.

All Linux kernel releases that include the unpatched icmp_tag_validation implementation are affected, specifically the kernel versions enumerated in the CVE such as 3.14 and 7.0 release candidates from rc1 through rc7, as indicated by the listed CPEs. The defect is part of the standard IPv4 ICMP handling code, so these kernel versions are at risk until the patch is applied.

The vulnerability has a CVSS score of 5.5, indicating moderate severity, and an EPSS score below 1%, implying a low probability of exploitation. It is not listed in the CISA KEV catalog. The attack requires only the ability to send crafted ICMP packets to a host with hardened PMTU enabled, which is a remote network‑based attack vector. Although not considered widely exploited, an attacker who can reach the target could cause a crash and disrupt availability.