A vulnerability in the Linux kernel’s icmp_send tracepoint allows a malicious user to trigger a kernel warning due to an uninitialized transport header read. The code unconditionally calls udp_hdr(skb) without verifying that the packet actually uses UDP, and __icmp_send can be invoked on packets where the transport header is never initialized. When the kernel is built with CONFIG_DEBUG_NET enabled, the uninitialized transport header causes a DEBUG_NET_WARN_ON_ONCE failure, potentially leading to a kernel panic and service disruption. The flaw does not provide direct code execution but can be leveraged to destabilize the host, especially in environments where detailed kernel tracing is active.

All Linux kernel releases that contain the affected icmp_send implementation are impacted, as the vulnerability is present across the canonical Linux kernel codebase. The CPE string indicates that any Linux kernel version is susceptible unless fixed by an overhaul of the transport header parsing logic.

The EPSS score is 0.00215 (<1%), and the vulnerability is not listed in the CISA KEV catalog, which suggests a lower profile threat. The flaw is exploitability‑limited to systems that have CONFIG_DEBUG_NET enabled and perform the specific icmp_send tracepoint. Nonetheless, the consequence of a kernel crash is severe, warranting prompt mitigation through kernel patching. Configuring the kernel to avoid the tracepoint or disabling debug net tracing can mitigate the risk in the absence of an official patch.