In the Linux kernel, the following vulnerability has been resolved:

net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown

mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst
with kfree() immediately, bypassing the RCU grace period.
In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from
the skb to the metadata_dst. This function requires RCU read-side
protection and the dst must remain valid until all RCU readers complete.
Since metadata_dst_free() calls kfree() directly, a use-after-free can
occur if any skb still holds a noref pointer to the dst when the driver
tears it down.
Replace metadata_dst_free() with dst_release() which properly goes
through the refcount path: when the refcount drops to zero, it schedules
the actual free via call_rcu_hurry(), ensuring all RCU readers have
completed before the memory is freed.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00184.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
2d7605a729062bb554f03c5983d8cfb8c0b42e9c affected < 72775977e89c25c99ee84d2c5baa3f86a8ba5cb4
2d7605a729062bb554f03c5983d8cfb8c0b42e9c affected < 459c6f35c58cf0fd5247e55d73ddaa29571d9b7e
2d7605a729062bb554f03c5983d8cfb8c0b42e9c affected < e634408d2b0cd939cfe019398a21fb47b7a8ffe3
2d7605a729062bb554f03c5983d8cfb8c0b42e9c affected < 2d86aeb46d5f69c704065a8c69822582787272a1
2d7605a729062bb554f03c5983d8cfb8c0b42e9c affected < 80df409e1a483676826a6c66e693dba6ac507751
Linux Linux affected
Version Status Constraints
6.2 affected —
0 unaffected < 6.2
6.6.143 unaffected ≤ 6.6.*
6.12.94 unaffected ≤ 6.12.*
6.18.36 unaffected ≤ 6.18.*
7.0.13 unaffected ≤ 7.0.*
7.1 unaffected ≤ *

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/2d86aeb46d5f69c704065a8c69822582787272a1 cve-icon
https://git.kernel.org/stable/c/459c6f35c58cf0fd5247e55d73ddaa29571d9b7e cve-icon
https://git.kernel.org/stable/c/72775977e89c25c99ee84d2c5baa3f86a8ba5cb4 cve-icon
https://git.kernel.org/stable/c/80df409e1a483676826a6c66e693dba6ac507751 cve-icon
https://git.kernel.org/stable/c/e634408d2b0cd939cfe019398a21fb47b7a8ffe3 cve-icon
History

Thu, 25 Jun 2026 12:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416

Thu, 25 Jun 2026 09:15:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, a use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed.
Title net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-06-25T08:39:40.654Z

Reserved: 2026-06-09T07:44:35.394Z

Link: CVE-2026-53247

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-25T12:00:13Z

Weaknesses