Executive brief
The Linux kernel's X.25 networking protocol implementation contains a use-after-free vulnerability in the socket cleanup path. When network neighbours are terminated, the kernel walks a list of associated sockets to disconnect them, but a race condition can cause the kernel to access freed memory if a socket closes concurrently. An attacker with local access could exploit this to crash the system or potentially execute arbitrary code.
Technical details
This is a use-after-free vulnerability in the net/x25/af_x25.c module, specifically in the x25_kill_by_neigh() function. The vulnerable code walks the global X.25 socket list under lock (x25_list_lock) but drops the lock before calling lock_sock(s). A race condition occurs when a concurrent x25_release() path removes a socket from the list and drops its final reference between the lock release and socket lock acquisition, causing the neighbouring teardown path to access freed memory. The fix takes a reference (sock_hold) while the list lock is held, rechecks the neighbour pointer after acquiring the socket lock to handle disconnections, and restarts the list walk after each disconnect since the lock was released. The vulnerability affects the X.25 protocol stack and requires local network access to the system.
Affected products
- Linux Linux kernel all versions (fix available since commit 5499e0602d2f)
Timeline
- 2026-08-10: disclosed: CVE-2026-68137 published
- 2026-07-23: patched: Fix committed upstream (commit 5499e0602d2f)