When a ROSE socket attempts to connect twice before the first attempt completes, the kernel overwrites the socket’s neighbour pointer with NULL. Closing the socket thereafter triggers a function that dereferences this NULL pointer, causing a kernel panic. The crash results in a denial of service; there is no evidence that an attacker can gain code execution or elevated privileges.

All Linux kernel versions that include the legacy ROSE networking module are affected. The vendor list indicates the Linux kernel itself, and no specific version range is provided, so any kernel still using the old rose_connect and rose_transmit_link logic is vulnerable.

The EPSS score is below 1 % and the vulnerability is not listed in the CISA KEV catalog, suggesting a low probability of widespread exploitation. An attacker would need local or sufficient privileged access to create a ROSE socket and trigger the double‑connect condition. The impact is a local denial of service; the element does not allow remote code execution or privilege escalation.