CVE-2026-53247 net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown
A use-after-free in the MediaTek Ethernet driver allows attackers to cause denial of service or execute arbitrary code via improper memory handling.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-53247?
CVE-2026-53247 is a critical use after free vulnerability in Linux kernel, published on 25 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown
mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, a use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed.
Weakness: CWE-416
Which versions are affected by CVE-2026-53247?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-53247?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-53247 being exploited?
There is no known exploitation of CVE-2026-53247 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-53247, DEBIAN-CVE-2026-53247, GHSA-mm4j-fwqr-3cf4, ROOT-OS-UBUNTU-2404-CVE-2026-53247, UBUNTU-CVE-2026-53247.