When a device doesn't have an IP address, as in ifconfig eth0 0.0.0.0, then dev->ip_ptr->indev == NULL. It is possible to craft a packet that crashes the kernel. Original bug report with fix: http://marc.info/?l=netfilter-devel&m=106668497403047&w=2 CVE assignment: http://seclists.org/oss-sec/2016/q1/226