PT-2026-52342 · Linux · Linux

Published 2026-06-25 · Updated 2026-06-25 · CVE-2026-53247

Mitre

In the Linux kernel, the following vulnerability has been resolved:

net: ethernet: mtk eth soc: Fix use-after-free in metadata dst teardown

mtk free dev() calls metadata dst free() which frees the metadata dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb dst set noref() sets a non-refcounted pointer from the skb to the metadata dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata dst free() calls kfree() directly, a use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata dst free() with dst release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call rcu hurry(), ensuring all RCU readers have completed before the memory is freed.

Related Identifiers

CVE-2026-53247

Affected Products

Linux

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-53247 · Security Note
• https://git.kernel.org/stable/c/459c6f35c58cf0fd5247e55d73ddaa29571d9b7e · Note
• https://git.kernel.org/stable/c/2d86aeb46d5f69c704065a8c69822582787272a1 · Note
• https://git.kernel.org/stable/c/80df409e1a483676826a6c66e693dba6ac507751 · Note
• https://git.kernel.org/stable/c/72775977e89c25c99ee84d2c5baa3f86a8ba5cb4 · Note
• https://git.kernel.org/stable/c/e634408d2b0cd939cfe019398a21fb47b7a8ffe3 · Note