Junglewise Threat Intelligence

CVE-2026-23460: Linux Kernel NULL pointer dereference in net/rose protocol

CVE-2026-23460 · Severity: medium · CVSS 5.5 · Published 2026-04-03

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's ROSE networking protocol could allow a local user to crash the system. By attempting to initiate a second connection while a first one is still pending, an attacker can trigger a system failure (NULL pointer dereference). This primarily impacts system availability and could lead to a denial-of-service condition.

Technical details

A NULL pointer dereference exists in the net/rose component of the Linux kernel. The rose_connect() function fails to check if a socket is already in the TCP_SYN_SENT state before proceeding with a new connection attempt. If a second connect() call is made while a connection is in progress, it can overwrite the rose->neighbour pointer with NULL. When the socket is later closed, rose_release() triggers rose_transmit_link() with a NULL neighbor pointer, resulting in a kernel panic. This issue has been resolved by adding a check to return -EALREADY if a connection is already in progress.

Affected products

  • Linux Linux Kernel from 2.6.12.1 up to 5.10.253, from 5.11 up to 5.15.203, from 5.16 up to 6.1.167, from 6.2 up to 6.6.130, from 6.7 up to 6.12.78, from 6.13 up to 6.18.20, from 6.19 up to 6.19.10

Timeline

  • 2026-03-25: patched: Patches committed to various stable branches.
  • 2026-04-03: disclosed: Initial publication of the CVE.

References

Related threats