CVE-2026-68137

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net/x25: fix use-after-free in x25_kill_by_neigh()<br /> <br /> x25_kill_by_neigh() walks the global X.25 socket list looking for sockets<br /> attached to a terminating neighbour. x25_list_lock protects list membership<br /> while the lookup is in progress, but it does not pin a socket&amp;#39;s lifetime<br /> after the lock is dropped.<br /> <br /> The function currently drops x25_list_lock before calling lock_sock(s). A<br /> concurrent close can run x25_release(), remove the same socket from<br /> x25_list, and drop the last socket reference in that window. The neighbour<br /> teardown path can then lock or inspect a freed struct sock/struct x25_sock.<br /> <br /> Take sock_hold(s) while x25_list_lock still proves that the list entry is<br /> live, then drop the temporary reference after the socket has been locked,<br /> rechecked, and released. Recheck x25_sk(s)-&gt;neighbour after lock_sock(),<br /> because another path may have disconnected the socket before this path<br /> acquired the socket lock. Restart the list walk after each disconnect<br /> because the list lock was dropped and the previous iterator state may no<br /> longer be valid.<br /> <br /> A QEMU/KASAN run against origin/master reproduced a slab-use-after-free in<br /> x25_kill_by_neigh().