CVE-2026-23460: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23460 is a NULL pointer dereference vulnerability in the Linux kernel's ROSE (Radio Over Switched Ethernet) socket implementation, specifically in the rose_transmit_link function triggered during a reconnect scenario. The flaw was discovered via syzkaller fuzzing and disclosed on April 3, 2026. It affects the Linux kernel from version 2.6.12 through multiple stable branches, with fixed versions including 5.10.253, 5.15.203, 6.1.167, 6.6.130, 6.12.78, 6.18.20, and 6.19.10. It carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory, Feedly).

The root cause is a missing state check in rose_connect() for the TCP_SYN_SENT state (CWE-476: NULL Pointer Dereference). When rose_connect() is called a second time while a connection attempt is already in progress, it overwrites rose->neighbour via rose_get_neigh(); if that call returns NULL, the socket is left in an inconsistent state (rose->state == ROSE_STATE_1 but rose->neighbour == NULL). Upon socket closure, rose_release() detects ROSE_STATE_1 and calls rose_write_internal() → rose_transmit_link(skb, NULL), dereferencing the NULL pointer and crashing the kernel. The fix adds a check for TCP_SYN_SENT in rose_connect() to return -EALREADY, consistent with POSIX connect(2) semantics. A reproducer is publicly available (syzkaller bug, GitHub Advisory).

Successful exploitation causes a kernel NULL pointer dereference, resulting in a kernel panic and system crash. The impact is limited to availability — there is no confidentiality or integrity compromise. A local user with low privileges can render the entire system unavailable, making this a local denial-of-service vulnerability (GitHub Advisory, Feedly).

No public proof-of-concept exploit code has been released beyond the syzkaller reproducer script available at a public GitHub Gist. There is no evidence of in-the-wild exploitation, no threat actor attribution, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.024% (0.000240), reflecting very low probability of exploitation in the near term (GitHub Advisory, syzkaller bug).

1. Gain local access: Obtain a low-privileged local user account on a vulnerable Linux system with the ROSE network protocol module loaded (AF_ROSE socket family available).
2. Create a ROSE socket: Open a ROSE socket using socket(AF_ROSE, SOCK_SEQPACKET, 0).
3. Initiate first connection: Call connect() on the socket to a target ROSE address, placing the socket in TCP_SYN_SENT state while the connection attempt is pending.
4. Call connect() a second time: Immediately call connect() again on the same socket before the first attempt completes, causing rose_connect() to overwrite rose->neighbour via rose_get_neigh(), which may return NULL.
5. Close the socket: Close the socket; rose_release() observes ROSE_STATE_1 and calls rose_write_internal() → rose_transmit_link(skb, NULL), dereferencing the NULL pointer and triggering a kernel panic (syzkaller bug, GitHub Advisory).

• Logs: Kernel oops or panic messages in /var/log/kern.log or dmesg output referencing rose_transmit_link, rose_write_internal, or rose_release with a NULL pointer dereference at address 0000000000000000.
• Process: Unexpected system crash or reboot; processes using AF_ROSE sockets (socket(AF_ROSE, ...)) visible in ss or netstat output immediately before crash.
• Kernel: Stack traces in crash dumps showing call chain: rose_release → rose_write_internal → rose_transmit_link with a NULL neighbour argument.

Apply the available Linux kernel patches that add a TCP_SYN_SENT state check to rose_connect(). Patched stable kernel versions are: 5.10.253, 5.15.203, 6.1.167, 6.6.130, 6.12.78, 6.18.20, and 6.19.10 (and 7.0-rc5 for mainline). As a workaround on systems that do not use ROSE networking, administrators can blacklist or unload the rose kernel module (modprobe -r rose / echo 'blacklist rose' >> /etc/modprobe.d/blacklist.conf). SUSE has issued security advisories (SUSE-SU-2026:2217-1 and SUSE-SU-2026:2238-1), and Debian has released updated kernel packages (GitHub Advisory, SUSE Advisory).

The vulnerability was reported through the syzkaller automated fuzzing infrastructure and disclosed via the Linux kernel CVE announcement mailing list. SUSE issued two security update announcements addressing this CVE, and Debian released updated kernel packages. The Yocto Project security mailing list also tracked the issue across multiple messages. No notable independent researcher commentary or significant social media discussion has been observed beyond standard vendor patch tracking (SUSE Advisory, Debian Tracker).