The Linux kernel's x25 protocol timers were managed using mod_timer() and timer_delete(), which did not hold references on the socket during timer callbacks. The x25_heartbeat_expiry() function could rearm timers after the socket was destroyed, causing __sock_put() to free the socket while a timer was still queued. Subsequent timer expiry would then access freed memory, triggering a slab-use-after-free detected by KASAN. The fix involves using sk_reset_timer() and sk_stop_timer() to ensure timers hold references to the socket, releasing them properly in expiry handlers, and only rearming heartbeat timers while the socket is still linked. This prevents use-after-free conditions and memory corruption.

This vulnerability could lead to use-after-free conditions in kernel memory, potentially causing system instability or crashes. However, no known exploits in the wild have been reported. The flaw affects the Linux kernel's x25 network stack and could be triggered by timer callbacks accessing freed socket memory.

A fix has been implemented in the Linux kernel to address this vulnerability by changing how x25 timers manage socket references. Users should update to the fixed kernel version once available. Since this is a kernel-level issue, applying the official kernel patch or upgrading to a kernel version containing this fix is the recommended remediation. No alternative mitigations are indicated.