CVE-2026-74628

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

net/x25: fix use-after-free of the socket by its timers

The x25 timers are armed with mod_timer() and cancelled with

timer_delete(), so a pending timer holds no reference on the socket and a

cancel does not wait for a callback already running on another CPU.

x25_heartbeat_expiry() also rearms unconditionally, so it can reinstall

sk->sk_timer after __x25_destroy_socket() has passed its cancel point.

The following __sock_put() frees the socket while the timer is still

queued, and the next expiry uses freed memory. KASAN reports a

slab-use-after-free on the kmalloc-2k object freed by close().

timer_delete_sync() cannot be used here: x25_heartbeat_expiry() and

x25_timer_expiry() both reach the cancels from inside the timer they

would wait on, through __x25_destroy_socket() and x25_disconnect().

Arm the timers with sk_reset_timer() and cancel them with sk_stop_timer()

so that an armed timer owns a reference, and relea

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References