Use-After-Free Vulnerability in Linux Kernel Ethernet Driver

CVE-2026-53247

What is CVE-2026-53247?

A use-after-free vulnerability has been identified in the Linux kernel's ethernet driver, specifically within the mtk_eth_soc component. This occurs due to a flaw in the teardown process of metadata destination structures (metadata_dst). The function mtk_free_dev() improperly frees the metadata_dst without ensuring that all RCU readers have completed, leading to potential system instability. To mitigate this risk, the implementation has been updated to use dst_release(), which properly manages reference counts and ensures safe memory freeing under the RCU grace period. Consequently, the risk associated with dangling pointers is significantly reduced, enhancing the overall security of the system.

References