CVE-2026-53247net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown
- 9.8CriticalCVSS base score
- 0.69%Exploitation in 30 daysEPSS · top 47% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, a use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed.
Timeline
ID reserved
By Linux
- 16 days later
· 16 days later
Published
- 41 days later
· 41 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| LinuxCNA (assigner) | 3.1 | Critical9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Analyzed | 3.1 | Critical9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.69% · top 47% of all CVEs (15 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.8.
Affected products
- affected 2d7605a729062bb554f03c5983d8cfb8c0b42e9c – < 72775977e89c25c99ee84d2c5baa3f86a8ba5cb4
- affected 2d7605a729062bb554f03c5983d8cfb8c0b42e9c – < 459c6f35c58cf0fd5247e55d73ddaa29571d9b7e
- affected 2d7605a729062bb554f03c5983d8cfb8c0b42e9c – < e634408d2b0cd939cfe019398a21fb47b7a8ffe3
- affected 2d7605a729062bb554f03c5983d8cfb8c0b42e9c – < 2d86aeb46d5f69c704065a8c69822582787272a1
- affected 2d7605a729062bb554f03c5983d8cfb8c0b42e9c – < 80df409e1a483676826a6c66e693dba6ac507751
- affected 6.2
- unaffected < 6.2
- unaffected 6.6.143 – ≤ 6.6.*
- unaffected 6.12.94 – ≤ 6.12.*
- unaffected 6.18.36 – ≤ 6.18.*
- unaffected 7.0.13 – ≤ 7.0.*
- unaffected 7.1 – ≤ *
References
References5
- https://git.kernel.org/stable/c/72775977e89c25c99ee84d2c5baa3f86a8ba5cb4 (opens in a new tab)
- https://git.kernel.org/stable/c/459c6f35c58cf0fd5247e55d73ddaa29571d9b7e (opens in a new tab)
- https://git.kernel.org/stable/c/e634408d2b0cd939cfe019398a21fb47b7a8ffe3 (opens in a new tab)
- https://git.kernel.org/stable/c/2d86aeb46d5f69c704065a8c69822582787272a1 (opens in a new tab)
- https://git.kernel.org/stable/c/80df409e1a483676826a6c66e693dba6ac507751 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-39198 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-53247)Record last updated .