CVE-2026-74628

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net/x25: fix use-after-free of the socket by its timers<br /> <br /> The x25 timers are armed with mod_timer() and cancelled with<br /> timer_delete(), so a pending timer holds no reference on the socket and a<br /> cancel does not wait for a callback already running on another CPU.<br /> <br /> x25_heartbeat_expiry() also rearms unconditionally, so it can reinstall<br /> sk-&gt;sk_timer after __x25_destroy_socket() has passed its cancel point.<br /> The following __sock_put() frees the socket while the timer is still<br /> queued, and the next expiry uses freed memory. KASAN reports a<br /> slab-use-after-free on the kmalloc-2k object freed by close().<br /> <br /> timer_delete_sync() cannot be used here: x25_heartbeat_expiry() and<br /> x25_timer_expiry() both reach the cancels from inside the timer they<br /> would wait on, through __x25_destroy_socket() and x25_disconnect().<br /> <br /> Arm the timers with sk_reset_timer() and cancel them with sk_stop_timer()<br /> so that an armed timer owns a reference, and release it in both expiry<br /> handlers. Rearm the heartbeat only while sk_hashed(sk) is still true,<br /> since __x25_destroy_socket() unlinks the socket before dropping it. Arm<br /> the deferred destroy timer the same way and drop its reference in<br /> x25_destroy_timer().<br /> <br /> Reproduced on net with KASAN, with the heartbeat period shortened so the<br /> window recurs. With this patch the reproducer no longer triggers a<br /> report and /proc/net/x25 drains.<br /> <br /> Discovered by XBOW, triaged by Baul Lee