CVE-2026-53212

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the netfilter nft tunnel component. The function nft tunnel obj destroy() invokes metadata dst free(), which performs a direct memory free of metadata dst while ignoring the dst entry reference count. This creates a dangling pointer for packets that previously acquired a reference via dst hold() in nft tunnel obj eval() and remain queued. When these packets are dequeued, dst release() attempts to operate on the already freed memory.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.