Use-after-free in Linux kernel - CVE-2026-74628

Vulnerability details

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the x25 socket timer handlers when processing timer callbacks during socket teardown. A local user can trigger timer activity on an x25 socket being destroyed to cause a denial of service.

The issue involves a race condition in which a timer callback may rearm after the socket has passed its cancel point, leading to use of freed memory on a subsequent timer expiry.

Affected software

How to mitigate CVE-2026-74628

External References

• https://git.kernel.org/stable/c/1fc9f6d2c7c9fdb341bfe8ca449c990632299ea6
• https://git.kernel.org/stable/c/2195424c3da2ef1829a63b807e3a900a90e57d85
• https://git.kernel.org/stable/c/3c4919be5d910db4beebca420953858606fba7d8
• https://git.kernel.org/stable/c/4bc522b33438fefc3272840ae5988771863a4f1f
• https://git.kernel.org/stable/c/6b79659590f0f82a9b8efd2ffd55ec6399ebfc33
• https://git.kernel.org/stable/c/e92c7e2b41d1528a830bc64c5e4e46dfa8133dda
• https://git.kernel.org/stable/c/fdd9ac50b9b61ef2b2d52c5156aff788be91454d

Related Security Bulletins

• Use-after-free in Linux kernel x25
• Debian update for linux