PT-2026-30154 · Linux · Linux Kernel

Syzkaller · Published 2026-04-03 · Updated 2026-04-20 · CVE-2026-23460

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The Linux kernel contained a flaw in the net/rose component where a NULL pointer dereference could occur in the rose transmit link function during a reconnect attempt. This issue arose because rose connect() lacked a check for the TCP SYN SENT state, allowing a second connection attempt while the first was in progress to overwrite rose->neighbour with NULL. Subsequently, closing the socket would lead to a call to rose write internal() and then rose transmit link(skb, NULL), resulting in the NULL pointer dereference.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2026-23460

ECHO-83A7-B8AD-5FCE

Affected Products

Linux Kernel

References · 20

• https://osv.dev/vulnerability/BELL-CVE-2026-23460 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-23460 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-23460 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23460 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-23460 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-UBUNTU-2204-CVE-2026-23460 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-UBUNTU-2404-CVE-2026-23460 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-23460 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-23460 · Security Note
• https://git.kernel.org/stable/c/a12254050e3050f1011cd24f3b880a6882d0139d · Note
• https://git.kernel.org/linus/e1f0a18c9564cdb16523c802e2c6fe5874e3d944 · Note
• https://git.kernel.org/stable/c/508f49ccbe0329641bb681f7d0052bb4e5943252 · Note
• https://git.kernel.org/stable/c/e1f0a18c9564cdb16523c802e2c6fe5874e3d944 · Note
• https://docs.bell-sw.com/security/cves/CVE-2026-23460 · Note
• https://twitter.com/CVEnew/status/2040111868484944314 · Twitter Post