CVE-2026-23460

Vulnerability

In the Linux kernel's ROSE protocol implementation, the rose_connect() function does not properly validate the socket state when a second connect() call is made while the first connection attempt is still in progress (TCP_SYN_SENT). Per POSIX, a second connect on a non-established socket should return -EALREADY, but the code instead proceeds to overwrite rose->neighbour via rose_get_neigh(), possibly setting it to NULL.

Exploitation

To trigger the vulnerability, an attacker must first initiate a ROSE connection (causing the socket to enter TCP_SYN_SENT state) and then call rose_connect() again before the handshake completes. If rose_get_neigh() returns NULL at that point, the socket will be left with rose->state == ROSE_STATE_1 but rose->neighbour == NULL. When the socket is later closed via rose_release(), the code path rose_write_internal() → rose_transmit_link(skb, NULL) dereferences the NULL pointer, causing a kernel crash (NULL pointer dereference).

Impact

An unprivileged local user with access to AF_ROSE sockets can trigger a kernel panic, leading to a denial of service (system crash). No authentication beyond local system access is required, and no special privileges are needed for the second connect call.

Mitigation

The fix adds a check for TCP_SYN_SENT in rose_connect() to return -EALREADY, preventing the race condition and NULL pointer dereference. The patch has been backported to multiple stable kernel trees as of April 2026 [1][2][3][4]. Users should apply the latest kernel updates from their distribution.