CVE-2026-74628

In the Linux kernel, the following vulnerability has been resolved:

net/x25: fix use-after-free of the socket by its timers

The x25 timers are armed with mod_timer() and cancelled with

timer_delete(), so a pending timer holds no reference on the socket and a

cancel does not wait for a callback already running on another CPU.

x25heartbeatexpiry() also rearms unconditionally, so it can reinstall

sk->sktimer after x25destroy_socket() has passed its cancel point.

The following _sockput() frees the socket while the timer is still

queued, and the next expiry uses freed memory.  KASAN reports a

slab-use-after-free on the kmalloc-2k object freed by close().

timerdeletesync() cannot be used here: x25heartbeatexpiry() and

x25timerexpiry() both reach the cancels from inside the timer they

would wait on, through _x25destroysocket() and x25disconnect().

Arm the timers with skresettimer() and cancel them with skstoptimer()

so that an armed timer owns a reference, and release it in both expiry

handlers.  Rearm the heartbeat only while sk_hashed(sk) is still true,

since _x25destroy_socket() unlinks the socket before dropping it.  Arm

the deferred destroy timer the same way and drop its reference in

x25destroytimer().

Reproduced on net with KASAN, with the heartbeat period shortened so the

window recurs.  With this patch the reproducer no longer triggers a

report and /proc/net/x25 drains.

Discovered by XBOW, triaged by Baul Lee baul.lee@xbow.com