An un-rate-limited ICMP/NDISC message vulnerability in the Linux kernel can be leveraged to facilitate denial of service attacks.

The vulnerability exists in the redirect handlers, which fail to rate-limit ICMP or NDISC messages when memory pressure prevents successful peer entry allocation. This is an unauthenticated vulnerability accessible over the network.

The lack of rate-limiting allows an attacker to flood network infrastructure or endpoints with ICMP/NDISC messages, leading to potential network degradation or denial of service. With a CVSS score of 7.5, this presents a high risk to network availability and performance.

Immediate Action: Update the Linux kernel to version 6.6.151, 6.12.103, 6.18.44, or 7.1.8 to include the necessary rate-limiting patches.

Proactive Monitoring: Monitor network traffic for unusual spikes in ICMP or NDISC packet volume that may indicate an attempt to leverage this flaw.

Compensating Controls: Implement network-level rate limiting on edge devices to mitigate the impact of excessive ICMP or NDISC traffic.

Public Exploit Available: No

Network stability is critical for business continuity. Administrators should apply the kernel updates promptly to ensure that ICMP and NDISC traffic remains properly rate-limited, thereby preventing potential network-based denial of service attacks.