A null-pointer dereference in the Linux kernel’s icmp_build_probe() routine can cause a system-wide kernel crash. When the IPv6 stack is not active, the function ipv6_dev_find() may return an error pointer; passing that pointer to dev_hold() triggers the crash. The flaw corresponds to CWE‑253 (Improper Check of Explicit Null Reference) and CWE‑476 (NULL pointer dereference). It results in a denial of service without granting privilege escalation.

All Linux kernel releases that include the vulnerable icmp_build_probe() implementation are affected, as no specific version list is available. The issue applies when IPv6 support is compiled as a module or disabled, impacting both IPv4 and IPv6 ICMP processing paths.

The likely attack vector is through network-based ICMP packets, as the description implies but does not explicitly state the vector. An attacker with network connectivity can craft an ICMP probe that triggers the crash. The EPSS score is < 1%, and the vulnerability is not listed in CISA KEV, yet the CVSS score of 7.5 indicates high severity. Exploitation causes a kernel crash and thus a denial of service but does not allow direct privilege escalation. The overall risk is moderate to high for systems exposed to untrusted networks that permit unsolicited ICMP traffic.