The Linux kernel, versions 3.9+, is vulnerable to a denial of service
attack with low rates of specially modified packets targeting IP fragment
re-assembly. An attacker may cause a denial of service condition by sending
specially crafted IP fragments. Various vulnerabilities in IP fragmentation
have been discovered and fixed over the years. The current vulnerability
(CVE-2018-5391) became exploitable in the Linux kernel with the increase of
the IP fragment reassembly queue size.

Juha-Matti Tilli discovered that the IP implementation in the Linux kernel
performed algorithmically expensive operations in some situations when
handling incoming packet fragments. A remote attacker could use this to
cause a denial of service.

tyhicks

CERT recommends reverting c2a936600f78aea00d3312ea4b66a79a4619f9b4