Re: slab-use-after-free in x25_transmit_restart_request

[Andrew Lunn]

On Tue, Sep 01, 2026 at 09:10:03PM +0800, luckdog wrote:
> Dear maintainers,
> 
> 
> I am reporting a slab use-after-free (UAF) in the X.25 neighbour/timer
> path. It was found by static auditing of net/x25 for timer-UAF patterns
> and then KASAN-verified. It is isomorphic to CVE-2025-21718 (rose_neigh):
> a refcounted neigh with an embedded self-re-arming timer whose free path
> does not synchronously stop the timer, so the timer callback can run
> after kfree(nb) and dereference freed memory. Observed on Linux v7.3-rc1.
> (commit: cee9395acd8043be0644b25c34bfa86623f2b935).
> 
> 
> This mail contains: the KASAN evidence, the buggy code, the root cause,
> the reproducible PoC (a small in-kernel delay-only helper + a userspace
> SABM/UA injector + the shell sequence), and a proposed fix.

Please could you just submit a proper fix patch.

    Andrew

---
pw-bot: cr