CVE-2026-68137
Received Received - Intake

Use-After-Free in Linux Kernel X.25 Protocol

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net/x25: fix use-after-free in x25_kill_by_neigh() x25_kill_by_neigh() walks the global X.25 socket list looking for sockets attached to a terminating neighbour. x25_list_lock protects list membership while the lookup is in progress, but it does not pin a socket's lifetime after the lock is dropped. The function currently drops x25_list_lock before calling lock_sock(s). A concurrent close can run x25_release(), remove the same socket from x25_list, and drop the last socket reference in that window. The neighbour teardown path can then lock or inspect a freed struct sock/struct x25_sock. Take sock_hold(s) while x25_list_lock still proves that the list entry is live, then drop the temporary reference after the socket has been locked, rechecked, and released. Recheck x25_sk(s)->neighbour after lock_sock(), because another path may have disconnected the socket before this path acquired the socket lock. Restart the list walk after each disconnect because the list lock was dropped and the previous iterator state may no longer be valid. A QEMU/KASAN run against origin/master reproduced a slab-use-after-free in x25_kill_by_neigh().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-68137
EUVD
EUVD-2026-55518

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux_kernel linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free vulnerability in the Linux kernel's X.25 network protocol implementation. The function x25_kill_by_neigh() searches for sockets linked to a terminating neighbor but fails to properly protect socket lifetimes. A race condition occurs when a concurrent socket close frees the socket before x25_kill_by_neigh() completes, leading to potential memory corruption or crashes.

Detection Guidance

This vulnerability is specific to the Linux kernel's X.25 network protocol implementation. Detection requires checking for kernel versions affected by the flaw and monitoring for use-after-free errors in the X.25 subsystem. Examine kernel logs for slab-use-after-free messages related to x25_kill_by_neigh(). Use commands like dmesg | grep -i 'x25' or journalctl -k | grep -i 'use-after-free' to identify potential issues.

Impact Analysis

This vulnerability could cause system instability, crashes, or privilege escalation if exploited. Systems using X.25 protocol may experience kernel panics or memory corruption. Attackers could potentially execute arbitrary code in the kernel context by triggering the use-after-free condition.

Mitigation Strategies

Apply the latest kernel security patches from your Linux distribution to resolve this issue. If immediate patching is not possible, disable the X.25 protocol module by unloading the x25 module (rmmod x25) or blacklisting it. Monitor kernel logs for any signs of exploitation or crashes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-68137. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart