External risk intelligence

Linux Kernel net/x25 Use-After-Free Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-74628

This vulnerability is located deep within the Linux kernel's X.25 protocol implementation. X.25 is a legacy networking protocol that is rarely used or exposed in modern, public-facing network environments. Exploitation requires specialized local configuration or specific socket management, making it highly unlikely to be exposed to or reachable from the public internet in typical deployments.

Use After Free

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses a vulnerability in the Linux kernel's X.25 networking component that could lead to system instability or crashes. The issue stems from how timers related to the X.25 socket are managed, potentially allowing a timer to access memory that has already been freed. While classified as critical, its practical impact is limited due to the rarity of X.25 protocol usage in modern systems.

A kernel flaw risks memory issues in X.25.
X.25 protocol's legacy use limits broad impact.
Confirm relevance and exposure for this specific technology.

Attack Path

How an attacker could exploit the issue

An attacker could exploit a use-after-free vulnerability in the Linux kernel's X.25 networking component. This vulnerability arises when the kernel attempts to use memory that has already been freed after a socket's timer expires. If an attacker can trigger specific timer events related to the X.25 socket, they could potentially cause the system to crash or execute arbitrary code with kernel privileges.

Network access is required.
Triggered by socket timer events.
Can lead to system instability or code execution.

Live Threat

Current exploitation, exposure, and threat context

The Linux kernel's X.25 networking component has a use-after-free vulnerability in its timer handling. This could lead to system instability or crashes when specific timer events occur after a socket has been freed.

Kernel memory corruption.
Timer callback on freed memory.
System instability or crashes.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability resides in the Linux kernel's X.25 networking component, suggesting that platform or infrastructure teams managing Linux systems with this specific protocol enabled are the primary stakeholders. The initial action involves identifying all Linux systems utilizing the X.25 protocol, assessing their business criticality and network exposure, and then locating the accountable system owners to formulate a remediation plan.

Linux platform owners should lead the response.
Verify X.25 protocol usage and exposure.
Plan kernel updates during maintenance.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Linux kernel X.25 component?

The X.25 component is a part of the Linux kernel that supports the X.25 protocol, a legacy packet-switching technology. While it was once a standard for wide-area networking, it has been largely superseded by modern networking stacks. Most contemporary systems do not require or use this legacy implementation, making it an obscure part of the kernel code for most modern server and desktop environments.

What does this CVE mean by use-after-free?

A use-after-free is a memory management error that occurs when a system continues to reference a piece of memory after it has been deleted or freed. In the context of CVE-2026-74628, the Linux kernel's timer system attempts to interact with an X.25 socket that has already been shut down and deallocated. This results in the kernel accessing invalid memory, which can cause unpredictable system behavior, such as crashes or potential unauthorized memory manipulation.

How is this timer-based vulnerability triggered?

The vulnerability is triggered by specific sequences of socket timer events within the X.25 subsystem. It requires the kernel to reach a state where a timer callback executes after the associated socket object has been destroyed. It is not triggered by standard network traffic alone; it depends on the precise, race-prone timing of socket teardowns and background kernel timer expirations. Simply having the protocol module loaded without specific socket activity does not typically initiate this flaw.

Do I need to worry about this on my network?

Halo Surface Signal indicates that this issue is very unlikely to affect typical environments because X.25 is rarely used or exposed today. While the vulnerability technically involves network-level interactions, the requirement for active X.25 socket management makes it highly improbable that your systems are reachable or exploitable via the public internet in standard modern configurations.

How should I respond to CVE-2026-74628?

The first step is to verify if your Linux systems have the X.25 protocol enabled or in use. Since this is a specialized legacy component, many systems will not have it active. If you identify environments where X.25 is necessary for business operations, coordinate with your infrastructure team to review kernel update schedules. Focus on identifying where the protocol is actually running before prioritizing maintenance, as systems without active X.25 usage are not impacted.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.