EUVD-2026-64565
GHSA-fp3m-qh7p-hcj7
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Triggered via local AF_X25 sockets not the network, so AV:L; success needs a timing race, so AC:H; unprivileged local socket creation gives PR:L; kernel heap UAF yields full C/I/A impact.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
net/x25: fix use-after-free of the socket by its timers
The x25 timers are armed with mod_timer() and cancelled with timer_delete(), so a pending timer holds no reference on the socket and a cancel does not wait for a callback already running on another CPU.
x25_heartbeat_expiry() also rearms unconditionally, so it can reinstall sk->sk_timer after __x25_destroy_socket() has passed its cancel point. The following __sock_put() frees the socket while the timer is still queued, and the next expiry uses freed memory. KASAN reports a slab-use-after-free on the kmalloc-2k object freed by close().
timer_delete_sync() cannot be used here: x25_heartbeat_expiry() and x25_timer_expiry() both reach the cancels from inside the timer they would wait on, through __x25_destroy_socket() and x25_disconnect().
Arm the timers with sk_reset_timer() and cancel them with sk_stop_timer() so that an armed timer owns a reference, and release it in both expiry handlers. Rearm the heartbeat only while sk_hashed(sk) is still true, since __x25_destroy_socket() unlinks the socket before dropping it. Arm the deferred destroy timer the same way and drop its reference in x25_destroy_timer().
Reproduced on net with KASAN, with the heartbeat period shortened so the window recurs. With this patch the reproducer no longer triggers a report and /proc/net/x25 drains.
Discovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>
AnalysisAI
Local privilege-relevant kernel memory corruption in the Linux kernel's net/x25 subsystem arises because X.25 socket timers are armed with mod_timer() and cancelled with timer_delete(), so a pending timer holds no reference on the socket. The x25_heartbeat_expiry() handler rearms unconditionally and can reinstall sk->sk_timer after __x25_destroy_socket() passes its cancel point, letting a subsequent expiry dereference the kmalloc-2k socket object already freed by close() - a use-after-free confirmed by KASAN. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires local access to a system where Linux X.25 support is present and the x25 module is loaded (CONFIG_X25), and the ability to create AF_X25 sockets and drive their timers through a close/destroy sequence. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The published CVSS 9.8 with vector AV:N/AC:L/PR:N/UI:N is almost certainly overstated for this bug: the description is a socket-lifetime use-after-free triggered through local socket operations and a close/timer race, not a remotely reachable network parser flaw, so the true attack vector is local (AV:L) with meaningful race-window complexity (AC:H) - this network-vs-local discrepancy should be verified against the vendor commit. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local unprivileged user on a host with the x25 module loaded opens an AF_X25 socket, drives it through a connect/close sequence while the heartbeat timer is pending, and wins the race where the timer rearms after the socket is unlinked and freed. The subsequent timer expiry operates on the freed kmalloc-2k object, giving a kernel use-after-free that a skilled attacker could shape into privilege escalation. … |
| Remediation | Apply the vendor-released patch: update to a Linux kernel build that includes the net/x25 timer-reference fix - stable release 6.18.45 is cited among the patched versions, and distribution kernels carrying the backport commits (4bc522b3, e92c7e2b, 2195424c, and NVD-listed 1fc9f6d2/3c4919be/6b79659/fdd9ac50) via git.kernel.org/stable. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory systems running Linux with X.25 networking enabled and document their business criticality and current kernel versions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today