CVE-2026-74628

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the x25 network protocol implementation. The x25 timers are managed using mod timer() and timer delete(), which does not ensure a reference is held on the socket or wait for callbacks running on other CPUs. Specifically, the x25 heartbeat expiry() function can reinstall sk->sk timer after x25 destroy socket() has passed its cancellation point. This allows sock put() to free the socket while a timer is still queued, leading to a slab-use-after-free when the timer expires and attempts to access the freed memory.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.