alt Hacker NewsIt’s possible to remotely crash any Linux kernel released over the last 11 years. A PoC hasn’t been published yet, but I don’t think that’ll be an issue.
It’s possible to remotely crash any Linux kernel released over the last 11 years. A PoC hasn’t been published yet, but I don’t think that’ll be an issue.
Almost anything with an active TCP listener, anyway. At least hypothetically, as we haven't seen it done publically yet.
It seems to rely on micro-second timing that isn't really available over generic public infra. Perhaps if chained with other techniques that allow the attacker to launch this from within someone's private infra, but then we're in the "if they're in they're in" realm.
There are published mitigations (disable syncookies, serialize queue) as well, so the number will shrink as systems are patched.
eta: also fixed in available kernels https://security-tracker.debian.org/tracker/CVE-2026-99288