CVE-2026-53247
published 2026-06-25CVE-2026-53247: In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown mtk_free_dev()…
PriorityP348critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.51%
39.8th percentile
In the Linux kernel, the following vulnerability has been resolved:
net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown
mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst
with kfree() immediately, bypassing the RCU grace period.
In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from
the skb to the metadata_dst. This function requires RCU read-side
protection and the dst must remain valid until all RCU readers complete.
Since metadata_dst_free() calls kfree() directly, a use-after-free can
occur if any skb still holds a noref pointer to the dst when the driver
tears it down.
Replace metadata_dst_free() with dst_release() which properly goes
through the refcount path: when the refcount drops to zero, it schedules
the actual free via call_rcu_hurry(), ensuring all RCU readers have
completed before the memory is freed.
Affected
16 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux | — | — |
| linux | linux | >= 2d7605a729062bb554f03c5983d8cfb8c0b42e9c < 72775977e89c25c99ee84d2c5baa3f86a8ba5cb4 | 72775977e89c25c99ee84d2c5baa3f86a8ba5cb4 |
| linux | linux | >= 2d7605a729062bb554f03c5983d8cfb8c0b42e9c < 459c6f35c58cf0fd5247e55d73ddaa29571d9b7e | 459c6f35c58cf0fd5247e55d73ddaa29571d9b7e |
| linux | linux | >= 2d7605a729062bb554f03c5983d8cfb8c0b42e9c < e634408d2b0cd939cfe019398a21fb47b7a8ffe3 | e634408d2b0cd939cfe019398a21fb47b7a8ffe3 |
| linux | linux | >= 2d7605a729062bb554f03c5983d8cfb8c0b42e9c < 2d86aeb46d5f69c704065a8c69822582787272a1 | 2d86aeb46d5f69c704065a8c69822582787272a1 |
| linux | linux | >= 2d7605a729062bb554f03c5983d8cfb8c0b42e9c < 80df409e1a483676826a6c66e693dba6ac507751 | 80df409e1a483676826a6c66e693dba6ac507751 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 6.13 < 6.18.36 | 6.18.36 |
| linux | linux_kernel | >= 6.19 < 7.0.13 | 7.0.13 |
| linux | linux_kernel | >= 6.2 < 6.6.143 | 6.6.143 |
| linux | linux_kernel | >= 6.7 < 6.12.94 | 6.12.94 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown mtk_free_dev() calls metadata_dst_free() which frees the m
ghsa_unreviewed·2026-06-25
CVE-2026-53247 In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown mtk_free_dev() calls metadata_dst_free() which frees the m
In the Linux kernel, the following vulnerability has been resolved:
net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown
mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst
with kfree() immediately, bypassing the RCU grace period.
In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from
the skb to the metadata_dst. This function requires RCU read-side
protection and the dst must remain valid until all RCU readers complete.
Since metadata_dst_free() calls kfree() directly, a use-after-free can
occur if any skb still holds a noref pointer to the dst when the driver
tears it down.
Replace metadata_dst_free() with dst_release() which properly goes
through the refcount path: when the refcount drops to zero, it schedules
the actual free via ca
Red Hat
kernel: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown
vendor_redhat·2026-06-25
CVE-2026-53247 CWE-825 kernel: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown
kernel: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown
In the Linux kernel, the following vulnerability has been resolved:
net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown
mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst
with kfree() immediately, bypassing the RCU grace period.
In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from
the skb to the metadata_dst. This function requires RCU read-side
protection and the dst must remain valid until all RCU readers complete.
Since metadata_dst_free() calls kfree() directly, a use-after-free can
occur if any skb still holds a noref pointer to the dst when the driver
tears it down.
Replace metadata_dst_free() with dst_release() which properly goes
through the refc
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/2d86aeb46d5f69c704065a8c69822582787272a1https://git.kernel.org/stable/c/459c6f35c58cf0fd5247e55d73ddaa29571d9b7ehttps://git.kernel.org/stable/c/72775977e89c25c99ee84d2c5baa3f86a8ba5cb4https://git.kernel.org/stable/c/80df409e1a483676826a6c66e693dba6ac507751https://git.kernel.org/stable/c/e634408d2b0cd939cfe019398a21fb47b7a8ffe3
2026-06-25
Published