Look up another CVE · open CVE-2026-68137 in the interactive tracker
CVE-2026-68137
net/x25: fix use-after-free in x25_kill_by_neigh()
Published 2026-08-10 (2 months ago) by the Linux kernel CNA. Subsystem net/x25. Debian urgency: not yet assigned.
Debian does not build this code. The per-release build detail is under "Where it lives" below.
What to do, per Debian release
Debian's own status for CVE-2026-68137 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixedDLA-4777-1 · 2026-09-08 · text | 6.1.187-1 | Update the kernel and reboot. DLA-4777-1 shipped the fix on 2026-09-08, in 6.1.187-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixed | 6.12.101-1 | Update the kernel and reboot. Fixed in 6.12.101-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.1.6-1 | Update the kernel and reboot. Fixed in 7.1.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.6-1 | Update the kernel and reboot. Fixed in 7.1.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian 12bookworm · linux-6.12 | fixedDLA-4745-1 · 2026-08-18 · text | 6.12.101-1~deb12u1 | Update the kernel and reboot. DLA-4745-1 shipped the fix on 2026-08-18, in 6.12.101-1~deb12u1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
x25_kill_by_neigh() walks the global X.25 socket list looking for sockets attached to a terminating neighbour. x25_list_lock protects list membership while the lookup is in progress, but it does not pin a socket's lifetime after the lock is dropped. The function currently drops x25_list_lock before calling lock_sock(s). A concurrent close can run x25_release(), remove the same socket from x25_list, and drop the last socket reference in that window. The neighbour teardown path can then lock or inspect a freed struct sock/struct x25_sock. Take sock_hold(s) while x25_list_lock still proves that the list entry is live, then drop the temporary reference after the socket has been locked, rechecked, and released. Recheck x25_sk(s)->neighbour after lock_sock(), because another path may have disconnected the socket before this path acquired the socket lock. Restart the list walk after each disconnect because the list lock was dropped and the previous iterator state may no longer be valid. A QEMU/KASAN run against origin/master reproduced a slab-use-after-free in x25_kill_by_neigh().
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
net/x25/af_x25.c
- What this is
- X.25 STACKMAINTAINERS section matched on net/x25/ · linux-x25@vger.kernel.org · Maintained
- Kernel module
- none to look for. The file would have gone into x25, and Debian does not compile it into that module, so finding x25 in lsmod would say nothing about this CVE.
Check it on the machine
grep -w CONFIG_X25 /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
Show whether Debian builds this, per release
Debian does not build this code. In 5 releases below, every kernel flavour Debian publishes has the switch off, so the vulnerable file is compiled into no kernel binary Debian ships.
- bookworm, trixie, forky, sid, bookworm · linux-6.12n
- n
- not enabled on any flavour - this release does not build the code
- Build switch
- CONFIG_X25
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-08-10 (2 months ago)source
- CVSS
- 9.8 critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- network (AV:N)source
- EPSS
- 0.54%, higher than 44.0% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- net/x25
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 5.10.110 | 5.10.265 | db6b04f6d655 |
| 5.15.33 | 5.15.216 | 5e8a754ac200 |
| 5.18 | 6.1.183 | c98a454d1a9e |
| 5.18 | 6.6.148 | 3f4fe26c20c3 |
| 5.18 | 6.12.101 | 610678d4be94 |
| 5.18 | 6.18.42 | ec6d91a1bf2e |
| 5.18 | 7.1.6 | 9aabda553184 |
| 5.18 | 7.2 | 5499e0602d2f |
| 4.9.311 | 0 | 0 |
| 4.14.276 | 0 | 0 |
| 4.19.238 | 0 | 0 |
| 5.4.189 | 0 | 0 |
| 5.16.19 | 0 | 0 |
| 5.17.2 | 0 | 0 |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4777-1 | 2026-09-08 | bookworm 6.1.187-1 | tracker |
| DLA-4745-1 | 2026-08-18 | bookworm 6.12.101-1~deb12u1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:NAttack vector, network
- x25_kill_by_neigh() is invoked from the net stack when inbound X.25 link-control frames (RESTART_REQUEST/CONFIRMATION with LCI 0, or IFACE_DISCONNECT) are processed on ARPHRD_X25 interfaces via the ETH_P_X25 packet handler, the normal WAN-facing path in telecom/banking/industrial X.25 deployments.
- AC:LAttack complexity, low
- This is a use-after-free race between neighbour teardown and socket close(); an attacker controls both sides by racing close() on an AF_X25 socket against RESTART/terminate frames they send, and KASAN reproduced the slab-UAF under controlled testing.
- PR:NPrivileges required, none
- A remote X.25 peer on the WAN needs no Linux credentials to deliver RESTART/terminate frames that reach x25_kill_by_neigh(); exploitation races that path against any local X.25 consumer closing sockets, without the attacker holding privileges on the victim host.
- UI:NUser interaction, none
- No victim user interaction is required beyond normal automated X.25 service operation (accepting calls, reconnecting, or closing sessions) that can be timed against remotely injected link-control frames.
- S:UScope, unchanged
- The vulnerability corrupts kernel heap memory within the host kernel security boundary; it does not cross VM, container, or IOMMU isolation boundaries.
- C:HConfidentiality impact, high
- Use-after-free on struct sock/x25_sock lets an attacker influence reuse of freed slab objects, enabling arbitrary kernel memory disclosure per CNA guidance for kernel UAF bugs.
- I:HIntegrity impact, high
- Use-after-free on socket structures can be leveraged through heap shaping into arbitrary kernel writes, privilege escalation, or code execution per CNA guidance for kernel UAF bugs.
- A:HAvailability impact, high
- The bug is a confirmed slab use-after-free in kernel context (KASAN-reproduced) that can oops or panic the kernel during lock_sock()/x25_disconnect() even before full exploit development.