CVE-2026-74628: Linux Kernel x25 Use-After-Free Vulnerability

CVE-2026-74628 Overview

CVE-2026-74628 is a use-after-free vulnerability in the Linux kernel's net/x25 subsystem. The flaw stems from improper timer lifecycle management on X.25 sockets. Timers were armed with mod_timer() and cancelled with timer_delete(), meaning a pending timer held no reference on the socket and cancellation did not wait for callbacks executing on other CPUs. The x25_heartbeat_expiry() handler rearms unconditionally, allowing it to reinstall sk->sk_timer after __x25_destroy_socket() passed its cancel point. A subsequent __sock_put() frees the socket while the timer remains queued, and the next expiry dereferences freed memory. KASAN reports a slab-use-after-free on the kmalloc-2k object freed by close().

Critical Impact
The use-after-free condition in the X.25 socket layer can lead to kernel memory corruption, potentially enabling denial of service or local privilege escalation on systems with the X.25 protocol enabled.

Affected Products

Linux kernel (multiple stable branches, per kernel.org commits)
Distributions shipping the net/x25 module with vulnerable timer handling
Systems with X.25 protocol support compiled or loaded

Discovery Timeline

Vulnerability discovered by XBOW, triaged by Baul Lee (baul.lee@xbow.com)
2026-08-22 - CVE-2026-74628 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-74628

Vulnerability Analysis

The vulnerability is a classic use-after-free (UAF) in the X.25 socket timer subsystem. X.25 sockets rely on two timers: a heartbeat timer managed by x25_heartbeat_expiry() and a general expiry timer managed by x25_timer_expiry(). Both were armed with mod_timer() and cancelled with timer_delete(), which is a non-synchronous cancellation primitive.

Because the pending timer held no reference count on the socket, teardown in __x25_destroy_socket() could proceed while a timer callback was still executing on another CPU. The heartbeat handler unconditionally rearmed the timer, so it could reinstall sk->sk_timer after cancellation. Following __sock_put(), the socket memory is freed while a timer is still queued, and the next timer expiry accesses freed memory.

Root Cause

The root cause is missing reference-count ownership by armed timers. timer_delete_sync() cannot be used as a fix because x25_heartbeat_expiry() and x25_timer_expiry() reach cancel points from inside the timer callbacks themselves through __x25_destroy_socket() and x25_disconnect(), which would cause the sync variant to deadlock waiting on the timer it is running in.

Attack Vector

Exploitation requires triggering the race window between timer expiry and socket destruction. The upstream reproducer shortens the heartbeat period so the window recurs, then repeatedly opens and closes X.25 sockets to force the callback path to overlap with close()-driven teardown. Freed slab memory in the kmalloc-2k cache can then be reallocated with attacker-controlled contents before the stale timer callback dereferences it.

No public exploit is available. The vulnerability requires local access to open X.25 sockets and the net/x25 module to be loaded.

The fix arms timers with sk_reset_timer() and cancels them with sk_stop_timer(), so an armed timer holds a socket reference. Both expiry handlers release that reference. The heartbeat rearm is gated on sk_hashed(sk) remaining true, since __x25_destroy_socket() unlinks the socket before dropping it. The deferred destroy timer is armed the same way, with its reference released in x25_destroy_timer(). See the upstream fix commits for the full patch.

Detection Methods for CVE-2026-74628

Indicators of Compromise

KASAN reports flagging slab-use-after-free on kmalloc-2k objects freed by x25_release/close() code paths
Kernel oops or panic traces referencing x25_heartbeat_expiry, x25_timer_expiry, or __x25_destroy_socket
Unexpected entries or stale sockets in /proc/net/x25 that fail to drain after connection close

Detection Strategies

Audit hosts for loaded x25 and x25_asy kernel modules using lsmod and inventory management tooling
Monitor dmesg and journal output for KASAN, general protection fault, or slab corruption warnings tied to X.25 symbols
Track kernel package versions against distribution advisories referencing the net/x25 timer fix

Monitoring Recommendations

Alert on unexpected loading of the x25 module on production Linux endpoints and servers
Forward kernel logs to a central data lake and search for x25_ function names in fault traces
Baseline processes that call socket(AF_X25, ...) and alert on new usage on systems that do not require X.25

How to Mitigate CVE-2026-74628

Immediate Actions Required

Apply the vendor-supplied kernel update that includes the net/x25 timer lifecycle fix
If patching is not immediately possible, blacklist and unload the x25 kernel module on systems that do not require the protocol
Restrict access to hosts where the x25 module must remain loaded and limit which users can create raw sockets

Patch Information

The fix has been merged into the mainline Linux kernel and backported across stable branches. Relevant commits include 1fc9f6d2c7c9, 2195424c3da2, 3c4919be5d91, 4bc522b33438, 6b79659590f0, ba925a2e98ce, e92c7e2b41d1, and fdd9ac50b9b6. Consult the kernel.org stable tree and your Linux distribution's advisory feed for backport availability.

Workarounds

Prevent module autoload by adding install x25 /bin/true to a file under /etc/modprobe.d/
Remove the x25 module at runtime with modprobe -r x25 when no active sessions require it
Restrict the CAP_NET_RAW capability and unprivileged socket creation on affected hosts

bash

# Disable the vulnerable X.25 module at boot
echo 'blacklist x25' | sudo tee /etc/modprobe.d/blacklist-x25.conf
echo 'install x25 /bin/true' | sudo tee -a /etc/modprobe.d/blacklist-x25.conf
sudo modprobe -r x25 2>/dev/null || true