A null-pointer dereference occurs in the Linux kernel’s icmp_build_probe() routine. When the IPv6 stack is not active (CONFIG_IPV6=m and not loaded), the function ipv6_stub->ipv6_dev_find() may return an error pointer. Passing this error pointer to dev_hold() triggers a null-pointer dereference, causing the kernel to crash. The crash can be induced by a specially crafted ICMP probe, leading to a denial of service that affects all users on the compromised system. The weakness is a classic null-pointer dereference (CWE‑476).

All Linux kernel releases that include the vulnerable icmp_build_probe() implementation are affected, with no specific version list available. The flaw applies to both IPv4 and IPv6 processing paths and becomes relevant when IPv6 support is compiled as a module or disabled. Any kernel running before the announced patch is at risk.

The flaw can be exploited remotely by sending crafted ICMP packets from an address that can reach the target. The EPSS score is not available, and the vulnerability is not listed in CISA KEV. Exploitation requires network connectivity and the ability to craft ICMP traffic; it leads to a kernel crash without directly providing privilege escalation. The overall risk is moderate to high for systems exposed to untrusted networks, particularly those that allow unrestricted ICMP traffic.