Use-After-Free Vulnerability in Linux Kernel Airoha Metadata

CVE-2026-53248

What is CVE-2026-53248?

A vulnerability in the Linux kernel's Airoha driver introduces a use-after-free condition during the teardown of metadata destinations. The issue arises when the function airoha_metadata_dst_free() attempts to free the metadata_dst without respecting the RCU (Read-Copy-Update) grace period. This misstep allows for memory that is still referenced by pointers to be prematurely released. Specifically, when skb_dst_set_noref() is called, it links a non-refcounted pointer from socket buffers (skb) to the metadata_dst, potentially leading to access violations if the memory is accessed after being freed. The resolution involves replacing metadata_dst_free() with dst_release(), ensuring proper reference counting and safe memory management.

References