{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-68137", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-30T09:28:09.370Z", "datePublished": "2026-08-10T11:59:00.740Z", "dateUpdated": "2026-08-19T16:29:54.672Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-19T16:29:54.672Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/x25: fix use-after-free in x25_kill_by_neigh()\n\nx25_kill_by_neigh() walks the global X.25 socket list looking for sockets\nattached to a terminating neighbour. x25_list_lock protects list membership\nwhile the lookup is in progress, but it does not pin a socket's lifetime\nafter the lock is dropped.\n\nThe function currently drops x25_list_lock before calling lock_sock(s). A\nconcurrent close can run x25_release(), remove the same socket from\nx25_list, and drop the last socket reference in that window. The neighbour\nteardown path can then lock or inspect a freed struct sock/struct x25_sock.\n\nTake sock_hold(s) while x25_list_lock still proves that the list entry is\nlive, then drop the temporary reference after the socket has been locked,\nrechecked, and released. Recheck x25_sk(s)->neighbour after lock_sock(),\nbecause another path may have disconnected the socket before this path\nacquired the socket lock. Restart the list walk after each disconnect\nbecause the list lock was dropped and the previous iterator state may no\nlonger be valid.\n\nA QEMU/KASAN run against origin/master reproduced a slab-use-after-free in\nx25_kill_by_neigh()." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL" }, "scenarios": [ { "lang": "en", "value": "AV:N - x25_kill_by_neigh() is invoked from the net stack when inbound X.25 link-control frames (RESTART_REQUEST/CONFIRMATION with LCI 0, or IFACE_DISCONNECT) are processed on ARPHRD_X25 interfaces via the ETH_P_X25 packet handler, the normal WAN-facing path in telecom/banking/industrial X.25 deployments.\nAC:L - This is a use-after-free race between neighbour teardown and socket close(); an attacker controls both sides by racing close() on an AF_X25 socket against RESTART/terminate frames they send, and KASAN reproduced the slab-UAF under controlled testing.\nPR:N - A remote X.25 peer on the WAN needs no Linux credentials to deliver RESTART/terminate frames that reach x25_kill_by_neigh(); exploitation races that path against any local X.25 consumer closing sockets, without the attacker holding privileges on the victim host.\nUI:N - No victim user interaction is required beyond normal automated X.25 service operation (accepting calls, reconnecting, or closing sessions) that can be timed against remotely injected link-control frames.\nS:U - The vulnerability corrupts kernel heap memory within the host kernel security boundary; it does not cross VM, container, or IOMMU isolation boundaries.\nC:H - Use-after-free on struct sock/x25_sock lets an attacker influence reuse of freed slab objects, enabling arbitrary kernel memory disclosure per CNA guidance for kernel UAF bugs.\nI:H - Use-after-free on socket structures can be leveraged through heap shaping into arbitrary kernel writes, privilege escalation, or code execution per CNA guidance for kernel UAF bugs.\nA:H - The bug is a confirmed slab use-after-free in kernel context (KASAN-reproduced) that can oops or panic the kernel during lock_sock()/x25_disconnect() even before full exploit development." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/x25/af_x25.c" ], "versions": [ { "version": "5c94b6205e87411dbe9dc1ca088eb36b8837fb47", "lessThan": "db6b04f6d65549bb1c7bc8e64a92e7b7d03be676", "status": "affected", "versionType": "git" }, { "version": "409570a619c1cda2e0fde6018a256b9e3d3ba0ee", "lessThan": "5e8a754ac2009a88a7b99ab61eab6296eed360f3", "status": "affected", "versionType": "git" }, { "version": "7781607938c8371d4c2b243527430241c62e39c2", "lessThan": "c98a454d1a9e1bd09d5fd55a7aa589b199340b88", "status": "affected", "versionType": "git" }, { "version": "7781607938c8371d4c2b243527430241c62e39c2", "lessThan": "3f4fe26c20c30bd5a2e2583e80685def0b27858c", "status": "affected", "versionType": "git" }, { "version": "7781607938c8371d4c2b243527430241c62e39c2", "lessThan": "610678d4be94b619c751572e8a58de705592cd07", "status": "affected", "versionType": "git" }, { "version": "7781607938c8371d4c2b243527430241c62e39c2", "lessThan": "ec6d91a1bf2ebd767d3d43f6d249ee0ed3f4558a", "status": "affected", "versionType": "git" }, { "version": "7781607938c8371d4c2b243527430241c62e39c2", "lessThan": "9aabda553184346f74810e2ee1d96920b4612e3f", "status": "affected", "versionType": "git" }, { "version": "7781607938c8371d4c2b243527430241c62e39c2", "lessThan": "5499e0602d2faafd42c580d25f615903c3fbe11b", "status": "affected", "versionType": "git" }, { "version": "dffc859d1d9560da594e4282091781b8d2715f00", "status": "affected", "versionType": "git" }, { "version": "858642789ada1b48630f322e59416ca9fca3e6b7", "status": "affected", "versionType": "git" }, { "version": "4c240c5a105557e4546d0836e694868f22fd09b0", "status": "affected", "versionType": "git" }, { "version": "9acf05b4e7b55fdb712ef7b331dbce5bcd391d0f", "status": "affected", "versionType": "git" }, { "version": "4a279d7ee1c65411b4055ecd428b8aa2b1711c1f", "status": "affected", "versionType": "git" }, { "version": "671529db75e6be777bb1c76aa07c2bdd2992be6d", "status": "affected", "versionType": "git" }, { "version": "5.10.110", "lessThan": "5.10.265", "status": "affected", "versionType": "semver" }, { "version": "5.15.33", "lessThan": "5.15.216", "status": "affected", "versionType": "semver" }, { "version": "4.9.311", "lessThan": "4.10", "status": "affected", "versionType": "semver" }, { "version": "4.14.276", "lessThan": "4.15", "status": "affected", "versionType": "semver" }, { "version": "4.19.238", "lessThan": "4.20", "status": "affected", "versionType": "semver" }, { "version": "5.4.189", "lessThan": "5.5", "status": "affected", "versionType": "semver" }, { "version": "5.16.19", "lessThan": "5.17", "status": "affected", "versionType": "semver" }, { "version": "5.17.2", "lessThan": "5.18", "status": "affected", "versionType": "semver" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/x25/af_x25.c" ], "versions": [ { "version": "5.18", "status": "affected" }, { "version": "0", "lessThan": "5.18", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.265", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.216", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.183", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.148", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.101", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.42", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.1.6", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10.110", "versionEndExcluding": "5.10.265" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15.33", "versionEndExcluding": "5.15.216" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18", "versionEndExcluding": "6.1.183" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18", "versionEndExcluding": "6.6.148" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18", "versionEndExcluding": "6.12.101" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18", "versionEndExcluding": "6.18.42" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18", "versionEndExcluding": "7.1.6" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18", "versionEndExcluding": "7.2" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9.311" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.14.276" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19.238" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4.189" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16.19" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.17.2" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/db6b04f6d65549bb1c7bc8e64a92e7b7d03be676" }, { "url": "https://git.kernel.org/stable/c/5e8a754ac2009a88a7b99ab61eab6296eed360f3" }, { "url": "https://git.kernel.org/stable/c/c98a454d1a9e1bd09d5fd55a7aa589b199340b88" }, { "url": "https://git.kernel.org/stable/c/3f4fe26c20c30bd5a2e2583e80685def0b27858c" }, { "url": "https://git.kernel.org/stable/c/610678d4be94b619c751572e8a58de705592cd07" }, { "url": "https://git.kernel.org/stable/c/ec6d91a1bf2ebd767d3d43f6d249ee0ed3f4558a" }, { "url": "https://git.kernel.org/stable/c/9aabda553184346f74810e2ee1d96920b4612e3f" }, { "url": "https://git.kernel.org/stable/c/5499e0602d2faafd42c580d25f615903c3fbe11b" } ], "title": "net/x25: fix use-after-free in x25_kill_by_neigh()", "x_generator": { "engine": "bippy-1.2.0" } } } }