CVE-2026-23460 net/rose: fix NULL pointer dereference in rose_transmit_link on reconnect
A local attacker can trigger a kernel crash by repeatedly connecting a ROSE socket, causing a NULL pointer dereference during socket release.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-23460?
CVE-2026-23460 is a medium-severity vulnerability in Linux kernel, published on 3 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
net/rose: fix NULL pointer dereference in rose_transmit_link on reconnect
syzkaller reported a bug [1], and the reproducer is available at [2].
ROSE sockets use four sk->sk_state values: TCP_CLOSE, TCP_LISTEN, TCP_SYN_SENT, and TCP_ESTABLISHED. rose_connect() already rejects calls for TCP_ESTABLISHED (-EISCONN) and TCP_CLOSE with SS_CONNECTING (-ECONNREFUSED), but lacks a check for TCP_SYN_SENT.
When rose_connect() is called a second time while the first connection attempt is still in progress (TCP_SYN_SENT), it overwrites rose->neighbour via rose_get_neigh(). If that returns NULL, the socket is left with rose->state == ROSE_STATE_1 but rose->neighbour == NULL. When the socket is subsequently closed, rose_release() sees ROSE_STATE_1 and calls rose_write_internal() -> rose_transmit_link(skb, NULL), causing a NULL pointer dereference.
Per connect(2), a second connect() while a connection is already in progress should return -EALREADY. Add this missing check for TCP_SYN_SENT to complete the state validation in rose_connect().
[1] https://syzkaller.appspot.com/bug?extid=d00f90e0af54102fb271 [2] https://gist.github.com/mrpre/9e6779e0d13e2c66779b1653fef80516
Weakness: CWE-476
Which versions are affected by CVE-2026-23460?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-23460?
Apply the vendor's patch.
Is CVE-2026-23460 being exploited?
There is no known exploitation of CVE-2026-23460 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-23460, DEBIAN-CVE-2026-23460, GHSA-cx6c-45wp-f5pr, ROOT-OS-DEBIAN-11-CVE-2026-23460, ROOT-OS-DEBIAN-12-CVE-2026-23460, ROOT-OS-DEBIAN-13-CVE-2026-23460 and 3 more.