CVE-2026-68137 (GCVE-0-2026-68137)
Vulnerability from cvelistv5
Published
2026-08-10 11:59
Modified
2026-08-19 16:29
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/x25: fix use-after-free in x25_kill_by_neigh()
x25_kill_by_neigh() walks the global X.25 socket list looking for sockets
attached to a terminating neighbour. x25_list_lock protects list membership
while the lookup is in progress, but it does not pin a socket's lifetime
after the lock is dropped.
The function currently drops x25_list_lock before calling lock_sock(s). A
concurrent close can run x25_release(), remove the same socket from
x25_list, and drop the last socket reference in that window. The neighbour
teardown path can then lock or inspect a freed struct sock/struct x25_sock.
Take sock_hold(s) while x25_list_lock still proves that the list entry is
live, then drop the temporary reference after the socket has been locked,
rechecked, and released. Recheck x25_sk(s)->neighbour after lock_sock(),
because another path may have disconnected the socket before this path
acquired the socket lock. Restart the list walk after each disconnect
because the list lock was dropped and the previous iterator state may no
longer be valid.
A QEMU/KASAN run against origin/master reproduced a slab-use-after-free in
x25_kill_by_neigh().
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 5c94b6205e87411dbe9dc1ca088eb36b8837fb47 Version: 409570a619c1cda2e0fde6018a256b9e3d3ba0ee Version: 7781607938c8371d4c2b243527430241c62e39c2 Version: 7781607938c8371d4c2b243527430241c62e39c2 Version: 7781607938c8371d4c2b243527430241c62e39c2 Version: 7781607938c8371d4c2b243527430241c62e39c2 Version: 7781607938c8371d4c2b243527430241c62e39c2 Version: 7781607938c8371d4c2b243527430241c62e39c2 Version: dffc859d1d9560da594e4282091781b8d2715f00 Version: 858642789ada1b48630f322e59416ca9fca3e6b7 Version: 4c240c5a105557e4546d0836e694868f22fd09b0 Version: 9acf05b4e7b55fdb712ef7b331dbce5bcd391d0f Version: 4a279d7ee1c65411b4055ecd428b8aa2b1711c1f Version: 671529db75e6be777bb1c76aa07c2bdd2992be6d Version: 5.10.110 ≤ Version: 5.15.33 ≤ Version: 4.9.311 ≤ Version: 4.14.276 ≤ Version: 4.19.238 ≤ Version: 5.4.189 ≤ Version: 5.16.19 ≤ Version: 5.17.2 ≤ |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/x25/af_x25.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "db6b04f6d65549bb1c7bc8e64a92e7b7d03be676",
"status": "affected",
"version": "5c94b6205e87411dbe9dc1ca088eb36b8837fb47",
"versionType": "git"
},
{
"lessThan": "5e8a754ac2009a88a7b99ab61eab6296eed360f3",
"status": "affected",
"version": "409570a619c1cda2e0fde6018a256b9e3d3ba0ee",
"versionType": "git"
},
{
"lessThan": "c98a454d1a9e1bd09d5fd55a7aa589b199340b88",
"status": "affected",
"version": "7781607938c8371d4c2b243527430241c62e39c2",
"versionType": "git"
},
{
"lessThan": "3f4fe26c20c30bd5a2e2583e80685def0b27858c",
"status": "affected",
"version": "7781607938c8371d4c2b243527430241c62e39c2",
"versionType": "git"
},
{
"lessThan": "610678d4be94b619c751572e8a58de705592cd07",
"status": "affected",
"version": "7781607938c8371d4c2b243527430241c62e39c2",
"versionType": "git"
},
{
"lessThan": "ec6d91a1bf2ebd767d3d43f6d249ee0ed3f4558a",
"status": "affected",
"version": "7781607938c8371d4c2b243527430241c62e39c2",
"versionType": "git"
},
{
"lessThan": "9aabda553184346f74810e2ee1d96920b4612e3f",
"status": "affected",
"version": "7781607938c8371d4c2b243527430241c62e39c2",
"versionType": "git"
},
{
"lessThan": "5499e0602d2faafd42c580d25f615903c3fbe11b",
"status": "affected",
"version": "7781607938c8371d4c2b243527430241c62e39c2",
"versionType": "git"
},
{
"status": "affected",
"version": "dffc859d1d9560da594e4282091781b8d2715f00",
"versionType": "git"
},
{
"status": "affected",
"version": "858642789ada1b48630f322e59416ca9fca3e6b7",
"versionType": "git"
},
{
"status": "affected",
"version": "4c240c5a105557e4546d0836e694868f22fd09b0",
"versionType": "git"
},
{
"status": "affected",
"version": "9acf05b4e7b55fdb712ef7b331dbce5bcd391d0f",
"versionType": "git"
},
{
"status": "affected",
"version": "4a279d7ee1c65411b4055ecd428b8aa2b1711c1f",
"versionType": "git"
},
{
"status": "affected",
"version": "671529db75e6be777bb1c76aa07c2bdd2992be6d",
"versionType": "git"
},
{
"lessThan": "5.10.265",
"status": "affected",
"version": "5.10.110",
"versionType": "semver"
},
{
"lessThan": "5.15.216",
"status": "affected",
"version": "5.15.33",
"versionType": "semver"
},
{
"lessThan": "4.10",
"status": "affected",
"version": "4.9.311",
"versionType": "semver"
},
{
"lessThan": "4.15",
"status": "affected",
"version": "4.14.276",
"versionType": "semver"
},
{
"lessThan": "4.20",
"status": "affected",
"version": "4.19.238",
"versionType": "semver"
},
{
"lessThan": "5.5",
"status": "affected",
"version": "5.4.189",
"versionType": "semver"
},
{
"lessThan": "5.17",
"status": "affected",
"version": "5.16.19",
"versionType": "semver"
},
{
"lessThan": "5.18",
"status": "affected",
"version": "5.17.2",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/x25/af_x25.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.18"
},
{
"lessThan": "5.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "5.10.110",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "5.15.33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.9.311",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.14.276",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.19.238",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.189",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.16.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.17.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/x25: fix use-after-free in x25_kill_by_neigh()\n\nx25_kill_by_neigh() walks the global X.25 socket list looking for sockets\nattached to a terminating neighbour. x25_list_lock protects list membership\nwhile the lookup is in progress, but it does not pin a socket\u0027s lifetime\nafter the lock is dropped.\n\nThe function currently drops x25_list_lock before calling lock_sock(s). A\nconcurrent close can run x25_release(), remove the same socket from\nx25_list, and drop the last socket reference in that window. The neighbour\nteardown path can then lock or inspect a freed struct sock/struct x25_sock.\n\nTake sock_hold(s) while x25_list_lock still proves that the list entry is\nlive, then drop the temporary reference after the socket has been locked,\nrechecked, and released. Recheck x25_sk(s)-\u003eneighbour after lock_sock(),\nbecause another path may have disconnected the socket before this path\nacquired the socket lock. Restart the list walk after each disconnect\nbecause the list lock was dropped and the previous iterator state may no\nlonger be valid.\n\nA QEMU/KASAN run against origin/master reproduced a slab-use-after-free in\nx25_kill_by_neigh()."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - x25_kill_by_neigh() is invoked from the net stack when inbound X.25 link-control frames (RESTART_REQUEST/CONFIRMATION with LCI 0, or IFACE_DISCONNECT) are processed on ARPHRD_X25 interfaces via the ETH_P_X25 packet handler, the normal WAN-facing path in telecom/banking/industrial X.25 deployments.\nAC:L - This is a use-after-free race between neighbour teardown and socket close(); an attacker controls both sides by racing close() on an AF_X25 socket against RESTART/terminate frames they send, and KASAN reproduced the slab-UAF under controlled testing.\nPR:N - A remote X.25 peer on the WAN needs no Linux credentials to deliver RESTART/terminate frames that reach x25_kill_by_neigh(); exploitation races that path against any local X.25 consumer closing sockets, without the attacker holding privileges on the victim host.\nUI:N - No victim user interaction is required beyond normal automated X.25 service operation (accepting calls, reconnecting, or closing sessions) that can be timed against remotely injected link-control frames.\nS:U - The vulnerability corrupts kernel heap memory within the host kernel security boundary; it does not cross VM, container, or IOMMU isolation boundaries.\nC:H - Use-after-free on struct sock/x25_sock lets an attacker influence reuse of freed slab objects, enabling arbitrary kernel memory disclosure per CNA guidance for kernel UAF bugs.\nI:H - Use-after-free on socket structures can be leveraged through heap shaping into arbitrary kernel writes, privilege escalation, or code execution per CNA guidance for kernel UAF bugs.\nA:H - The bug is a confirmed slab use-after-free in kernel context (KASAN-reproduced) that can oops or panic the kernel during lock_sock()/x25_disconnect() even before full exploit development."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:29:54.672Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/db6b04f6d65549bb1c7bc8e64a92e7b7d03be676"
},
{
"url": "https://git.kernel.org/stable/c/5e8a754ac2009a88a7b99ab61eab6296eed360f3"
},
{
"url": "https://git.kernel.org/stable/c/c98a454d1a9e1bd09d5fd55a7aa589b199340b88"
},
{
"url": "https://git.kernel.org/stable/c/3f4fe26c20c30bd5a2e2583e80685def0b27858c"
},
{
"url": "https://git.kernel.org/stable/c/610678d4be94b619c751572e8a58de705592cd07"
},
{
"url": "https://git.kernel.org/stable/c/ec6d91a1bf2ebd767d3d43f6d249ee0ed3f4558a"
},
{
"url": "https://git.kernel.org/stable/c/9aabda553184346f74810e2ee1d96920b4612e3f"
},
{
"url": "https://git.kernel.org/stable/c/5499e0602d2faafd42c580d25f615903c3fbe11b"
}
],
"title": "net/x25: fix use-after-free in x25_kill_by_neigh()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68137",
"datePublished": "2026-08-10T11:59:00.740Z",
"dateReserved": "2026-07-30T09:28:09.370Z",
"dateUpdated": "2026-08-19T16:29:54.672Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…