A critical use-after-free vulnerability in the Linux kernel X.25 protocol implementation exposes systems to potential memory corruption or unauthorized code execution.

This vulnerability occurs in the x25_kill_by_neigh function, where a race condition allows a socket to be accessed after it has been freed. The flaw stems from improper reference counting when dropping the x25_list_lock during neighbor teardown, which can be triggered by an unauthenticated attacker.

Successful exploitation of this flaw can lead to system instability, denial of service, or potential arbitrary code execution with kernel-level privileges. Given the CVSS score of 9.8, this vulnerability poses a severe risk to infrastructure availability and data integrity, as kernel-level compromise grants an attacker full control over the affected system.

Immediate Action: Update the Linux kernel to the corrected versions (5.10.265, 5.15.216, 6.1.183, or 6.6.148) or the latest stable release provided by your distribution vendor.

Proactive Monitoring: Monitor system logs for kernel panic events or unexpected crashes associated with network stack operations, which may indicate attempted exploitation.

Compensating Controls: If patching is not immediately feasible, disable the X.25 protocol module if it is not required for operational purposes to reduce the attack surface.

Public Exploit Available: Unknown.

This vulnerability represents a critical security flaw within the core networking stack of the Linux kernel. System administrators should prioritize the deployment of kernel security updates across all affected production environments to eliminate the risk of memory corruption and potential system compromise. Immediate patching is the only effective method to remediate this issue.