An improper reference release in the Linux kernel’s X.25 networking subsystem allows an attacker to trigger a use‑after‑free in the function x25_kill_by_neigh(). The flaw occurs when the function drops the list lock before obtaining a socket lock, permitting a concurrent close to free the socket while the iterator is still in use. This results in a memory corruption that can be abused to inject arbitrary code or halt the kernel, a classic example of CWE‑416. The official description acknowledges that the fix eliminates a slab-use-after-free detected by KASAN during testing.

The affected product is the Linux kernel, with no specific release numbers given in the advisory. The vulnerability exists in the origin/master branch and any kernels compiling that code prior to the applied commits. No vendor‑specific version strings are supplied.

The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, so the observable exploit likelihood is unknown. However, based on the nature of the flaw and its potential to allow arbitrary code execution, the risk is considered significant for systems that expose X.25 networking. The likely attack vector is through network traffic that invokes the X.25 protocol; an attacker could send crafted packets to a host that has the vulnerable code loaded. The absence of a CVSS score means the severity cannot be quantified, but typical use‑after‑free conditions in the kernel are often considered high impact.