Re: [PATCH net] net/x25: fix use-after-free in x25_kill_by_neigh()
From: Jakub Kicinski <kuba@kernel.org>
Date: 2026-07-27 22:55:10
Also in:
stable
On Sun, 26 Jul 2026 14:33:30 +0900 Baul Lee wrote:
x25_kill_by_neigh() walks x25_list under x25_list_lock and, for every socket bound to the dying neighbour, drops the lock to call lock_sock() / x25_disconnect() / release_sock() before re-acquiring it and continuing the iteration. It holds no reference on the socket across this window.
already fixed.