CVE-2026-53248

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the airoha network driver during metadata dst teardown. The function airoha metadata dst free() invokes metadata dst free(), which uses kfree() to release metadata dst immediately, bypassing the RCU (Read-Copy-Update) grace period. In the RX path, skb dst set noref() assigns a non-refcounted pointer from the skb to the metadata dst. This process requires RCU read-side protection to ensure the dst remains valid until all RCU readers finish. Because metadata dst free() frees memory directly, a use-after-free occurs if an skb still holds a noref pointer to the dst during teardown.

Recommendations Replace the metadata dst free() function with dst release() to ensure the refcount path is followed and memory is freed via call rcu hurry() only after all RCU readers have completed.