Linux Kernel EUVD-2026-26610

This vulnerability affects the X.25 protocol implementation in the Linux kernel networking stack, specifically the receive frame processing path. X.25 is a legacy packet-switched network protocol defined in the ISO/IEC 8208 standard, still used in some industrial control systems and legacy telecommunications infrastructure. The bug is a use-after-free/double-free memory corruption issue in error handling code. When x25_queue_rx_frame attempts to allocate a socket buffer via alloc_skb and fails, it frees the original skb and returns an error code. However, the calling function x25_backlog_rcv misinterprets the return value chain (through x25_state3_machine and x25_process_rx_frame) and frees the same skb again. This represents a classic reference counting error where error propagation semantics are inconsistent across the call stack. The affected code path has existed since the initial git import (commit 1da177e4c3f4), indicating a 20+ year old latent defect. Double-free vulnerabilities can lead to heap corruption, potentially exploitable for arbitrary code execution if an attacker can control heap layout and trigger the condition reliably.