A critical use-after-free vulnerability in the Linux kernel X.25 network implementation could allow an unauthenticated attacker to trigger memory corruption or arbitrary code execution.

The vulnerability exists in the net/x25 subsystem where socket timers do not correctly manage object references. An attacker can trigger a condition where a timer continues to reference a freed socket, leading to a use-after-free scenario that is reachable by an unauthenticated user.

The vulnerability carries a CVSS score of 9.8, indicating a critical risk to system integrity, availability, and confidentiality. Successful exploitation could lead to full system compromise, allowing an attacker to execute arbitrary code with kernel-level privileges, potentially leading to unauthorized data access or complete service disruption.

Immediate Action: Apply the latest kernel patches provided by your distribution vendor or update the Linux kernel to versions 5.10.267, 5.15.217, 6.1.184, or 6.6.153 as applicable.

Proactive Monitoring: Monitor system logs for kernel oops, segmentation faults, or unusual crash reports that may indicate memory corruption attempts.

Compensating Controls: If patching is not immediately feasible, restrict access to the affected system and disable the x25 module if it is not required for production operations.

Public Exploit Available: Unknown.

Given the critical nature of kernel-level vulnerabilities, organizations should prioritize patching their Linux environments. Ensure that kernel updates are tested in a staging environment and deployed to production as soon as possible to mitigate the risk of remote code execution.