CVE-2026-23460

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/rose: fix NULL pointer dereference in rose_transmit_link on reconnect

syzkaller reported a bug [1], and the reproducer is available at [2].

ROSE sockets use four sk->sk_state values: TCP_CLOSE, TCP_LISTEN,

TCP_SYN_SENT, and TCP_ESTABLISHED. rose_connect() already rejects

calls for TCP_ESTABLISHED (-EISCONN) and TCP_CLOSE with SS_CONNECTING

(-ECONNREFUSED), but lacks a check for TCP_SYN_SENT.

When rose_connect() is called a second time while the first connection

attempt is still in progress (TCP_SYN_SENT), it overwrites

rose->neighbour via rose_get_neigh(). If that returns NULL, the socket

is left with rose->state == ROSE_STATE_1 but rose->neighbour == NULL.

When the socket is subsequently closed, rose_release() sees

ROSE_STATE_1 and calls rose_write_internal() ->

rose_transmit_link(skb, NULL), causing a NULL pointer dereference.

Per connect(2), a second connect() while a connection is already in

progress shoul

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References