I've spent the last four days investigating and fine-tuning a remote DoS against the Linux kernel's TIPC implementation. A remote peer-state transition can trigger a NULL pointer dereference in TIPC's name-distribution path, causing a kernel panic and taking down the host.

I've really enjoyed digging into this, and I'm pretty happy with how the research turned out.