CVE-2026-53247

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the mtk eth soc ethernet driver. The mtk free dev() function calls metadata dst free(), which uses kfree() to immediately release metadata dst memory, bypassing the RCU (Read-Copy-Update) grace period. In the RX path, skb dst set noref() assigns a non-refcounted pointer from the skb to the metadata dst. Because this process requires RCU read-side protection, the destination must remain valid until all RCU readers finish. The direct use of kfree() allows a use-after-free condition if an skb still holds a pointer to the destination during teardown.

Recommendations Replace the metadata dst free() function with dst release() to ensure the refcount path is followed and memory is freed via call rcu hurry() only after all RCU readers have completed.