- Fix to defend against double event deletion, that could cause

  event corruption and use after free, for comm_timer_disable.

Author: wcawijngaards

doc/Changelog

@@ -1,3 +1,7 @@
+21 August 2026: Wouter
+	- Fix to defend against double event deletion, that could cause
+	  event corruption and use after free, for comm_timer_disable.
+
 11 August 2026: Wouter
 	- Fix #1492 from zacek: Data race in log_init() on
 	  key_created/log_lock when calling ub_ctx_create()

util/netevent.c

@@ -7036,8 +7036,12 @@ comm_timer_disable(struct comm_timer* timer)
 {
 	if(!timer)
 		return;
-	ub_timer_del(timer->ev_timer->ev);
-	timer->ev_timer->enabled = 0;
+	/* The event backend can not always deal with event del if it was not
+	 * added before. For that, there is a check if it was added here.*/
+	if(timer->ev_timer->enabled) {
+		ub_timer_del(timer->ev_timer->ev);
+		timer->ev_timer->enabled = 0;
+	}
 }
 
 void