CVE-2026-74628
Received Received - Intake

Use-After-Free in Linux Kernel X.25 Protocol Stack

Publication date: 2026-08-22

Last updated on: 2026-08-22

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net/x25: fix use-after-free of the socket by its timers The x25 timers are armed with mod_timer() and cancelled with timer_delete(), so a pending timer holds no reference on the socket and a cancel does not wait for a callback already running on another CPU. x25_heartbeat_expiry() also rearms unconditionally, so it can reinstall sk->sk_timer after __x25_destroy_socket() has passed its cancel point. The following __sock_put() frees the socket while the timer is still queued, and the next expiry uses freed memory. KASAN reports a slab-use-after-free on the kmalloc-2k object freed by close(). timer_delete_sync() cannot be used here: x25_heartbeat_expiry() and x25_timer_expiry() both reach the cancels from inside the timer they would wait on, through __x25_destroy_socket() and x25_disconnect(). Arm the timers with sk_reset_timer() and cancel them with sk_stop_timer() so that an armed timer owns a reference, and release it in both expiry handlers. Rearm the heartbeat only while sk_hashed(sk) is still true, since __x25_destroy_socket() unlinks the socket before dropping it. Arm the deferred destroy timer the same way and drop its reference in x25_destroy_timer(). Reproduced on net with KASAN, with the heartbeat period shortened so the window recurs. With this patch the reproducer no longer triggers a report and /proc/net/x25 drains. Discovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-22
Last Modified
2026-08-22
Generated
2026-08-22
AI Q&A
2026-08-22
EPSS Evaluated
N/A
NVD
CVE-2026-74628
EUVD
EUVD-2026-64565

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free vulnerability in the Linux kernel's X.25 networking protocol implementation. It occurs when timers associated with X.25 sockets are not properly managed, leading to a timer callback accessing freed memory. The issue arises because timers are armed without holding a socket reference, and cancellation does not wait for running callbacks. This allows a timer to reinstall itself after socket destruction, causing a slab-use-after-free when the timer expires.

Detection Guidance

This vulnerability is specific to the Linux kernel's X.25 network protocol implementation and requires kernel-level detection. No direct network or system commands are provided in the context to detect this use-after-free issue. Monitoring kernel logs for slab-use-after-free errors related to kmalloc-2k objects may indicate exploitation, but this is not a definitive detection method.

Impact Analysis

If exploited, this vulnerability could allow an attacker to crash the system or potentially execute arbitrary code with kernel privileges. It may lead to denial-of-service conditions, system instability, or unauthorized access to sensitive data. Systems running vulnerable Linux kernels with X.25 networking enabled are at risk.

Mitigation Strategies

Apply the kernel patch described in the CVE to fix the use-after-free issue in the X.25 protocol timers. Update to a Linux kernel version that includes this fix. If immediate patching is not possible, disable the X.25 protocol module (CONFIG_X25) if not required by your system.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74628. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart