A use‑after‑free flaw exists in the Linux kernel’s X25 socket timers. The flaw is triggered when a timer callback accesses a socket that has already been freed during the close operation, allowing the kernel to read or write memory that it no longer owns. This can cause a panic, memory corruption, or privileged execution. The weakness is an instance of improper release of kernel resources (CWE‑825).

The vulnerability affects all Linux kernel releases that include the X25 networking subsystem. No specific kernel version range is stated in the advisories, meaning any kernel with X25 support compiled and enabled is potentially affected. Systems that expose X25 networking to untrusted networks, or that keep the X25 module loaded, are at risk.

The CVSS score of 9.8 classifies this as a critical vulnerability. The EPSS score is below 1 %, indicating that exploitation is unlikely to be widespread, yet the flaw allows an attacker to trigger a use‑after‑free that could lead to a kernel crash or privilege escalation. The issue is not listed in the CISA KEV catalog. The attack vector is inferred to be remote network traffic over X25; an attacker could send malformed packets or force a socket close while timers are active. As the flaw relies on timer callbacks and kernel memory management, exploitation would require the X25 code to be loaded and the timer infrastructure to be running; thus, disabling X25 can mitigate exposure. Given the high severity, immediate patching is recommended in environments where X25 is required.