CVE-2026-74628: Linux Kernel Use-After-Free of X.25 Sockets by Their Timers

X.25 sockets in the Linux kernel arm their timers with mod_timer and cancel them with timer_delete. A pending timer holds no reference on the socket, and the cancel does not wait for a callback already running on another CPU. The heartbeat handler also rearms itself unconditionally, so it can reinstall the timer after socket teardown has passed its cancel point.

The socket is then freed while the timer is still queued, and the next expiry runs against freed memory. KASAN confirms a slab use-after-free on the object freed by close(). The CVE carries a CVSS score of 9.8. The fix makes armed timers own a socket reference and stops rearming once the socket is unhashed.