I started getting this since 4.15.15. It's easy to trigger, for example I get new IP address via dhcp (NetworkManager), then ss -K the_old_ip_address .
Happens on Ryzen and SandyBridge systems. My guess of the cause: commit 960058fe196397aecb16bb14e64980e265d2bc5e (didn't try reverting) BUG: unable to handle kernel NULL pointer dereference at 000030 IP: tcp_retransmit_skb+0x57/0xc0 PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 0 PID: 0 Comm: swapper/0 Tainted: G W 4.15.17+ #42 Hardware name: To Be Filled By O.E.M./To Be Filled By O.E.M./X370 Taichi, BIOS P4.60 03/02/2018 RIP: 0010:tcp_retransmit_skb+0x57/0xc0 RSP: 0018:ffff95b1dea03e00 EFLAGS: 00010206 RAX: 00000000fffffff5 RBX: ffff95b15876d000 RCX: 5 RDX: 5 RSI: 0 RDI: ffff95b115876d000 ... Call Trace: <IRQ> tcp_retransmit_timer tcp_write_timer_handler tcp_write_timer ? tcp_write_timer_handler expire_timers run_timer_softirq sched_clock sched_clock sched_clock_cpu irqtime_account_irq __do_softirq sched_clock irq_exit smp_apic_timer_interrupt apic_timer_interrupt </IRQ> -- Do what you love because life is too short for anything else.