Executive brief
The Linux kernel's X.25 network protocol implementation contains a use-after-free vulnerability in its socket timer management. When sockets are closed while timers are pending, the timers can fire after the socket memory has been freed, potentially allowing local attackers to cause system crashes or execute arbitrary code. This affects systems using X.25 networking, which is primarily found in legacy telecommunications and specialized industrial networks.
Technical details
The vulnerability is a use-after-free in the X.25 protocol handler (net/x25) caused by improper timer lifecycle management. The x25_heartbeat_expiry() timer can unconditionally rearm itself after __x25_destroy_socket() has cancelled it, allowing the timer to be reinstalled after the socket is freed. Since mod_timer() and timer_delete() do not manage socket reference counts, the socket is freed while the timer remains queued. When the timer subsequently expires, it accesses freed memory (kmalloc-2k slab object). The fix replaces mod_timer()/timer_delete() with sk_reset_timer()/sk_stop_timer(), which properly manage reference counting, and prevents rearmament of the heartbeat timer after socket unlinking. KASAN detects the slab-use-after-free when close() is called. Patch is available in mainline and stable branches.
Affected products
- Linux Linux kernel All versions since 2.6.12-rc2; patched in stable branches
Timeline
- 2026-08-22: disclosed: CVE-2026-74628 published
- 2026-07-30: patched: Fix committed upstream (2195424c3da2ef1829a63b807e3a900a90e57d85)
- 2026-07-27: other: Discovered by XBOW, triaged by Baul Lee