From: Andrew Lunn <andrew@lunn.ch>
To: luckdog <luckd0g@163.com>
Cc: horms@kernel.org, kuba@kernel.org, ms@dev.tdt.de,
davem@davemloft.net, edumazet@google.com, pabeni@redhat.com,
linux-x25@vger.kernel.org, netdev@vger.kernel.org,
linux-kernel@vger.kernel.org
Subject: Re: slab-use-after-free in x25_transmit_restart_request
Date: Tue, 1 Sep 2026 16:23:23 +0200 [thread overview]
Message-ID: <8bcfd8db-b65f-4644-868b-7489f936d604@lunn.ch> (raw)
In-Reply-To: <592ed71c.a1fe.1a05d174f12.Coremail.luckd0g@163.com>
On Tue, Sep 01, 2026 at 09:10:03PM +0800, luckdog wrote:
> Dear maintainers,
>
>
> I am reporting a slab use-after-free (UAF) in the X.25 neighbour/timer
> path. It was found by static auditing of net/x25 for timer-UAF patterns
> and then KASAN-verified. It is isomorphic to CVE-2025-21718 (rose_neigh):
> a refcounted neigh with an embedded self-re-arming timer whose free path
> does not synchronously stop the timer, so the timer callback can run
> after kfree(nb) and dereference freed memory. Observed on Linux v7.3-rc1.
> (commit: cee9395acd8043be0644b25c34bfa86623f2b935).
>
>
> This mail contains: the KASAN evidence, the buggy code, the root cause,
> the reproducible PoC (a small in-kernel delay-only helper + a userspace
> SABM/UA injector + the shell sequence), and a proposed fix.
Please could you just submit a proper fix patch.
Andrew
---
pw-bot: cr
prev parent reply other threads:[~2026-09-01 14:23 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-01 13:10 slab-use-after-free in x25_transmit_restart_request luckdog
2026-09-01 14:23 ` Andrew Lunn [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=8bcfd8db-b65f-4644-868b-7489f936d604@lunn.ch \
--to=andrew@lunn.ch \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=horms@kernel.org \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-x25@vger.kernel.org \
--cc=luckd0g@163.com \
--cc=ms@dev.tdt.de \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox