Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

CVE-2026-53247: Linux kernel Ethernet driver can free memory too soon

CVE-2026-53247 · published 3 months ago
Summary

The Ethernet driver in recent Linux kernel releases for Debian and several Canonical kernels can release a piece of memory before it is safe, potentially causing the system to crash or behave unpredictably. This happens when the driver removes network metadata while some network packets still reference it. Install the latest kernel updates from your distribution as soon as they are available to apply the fix.

What to do
  • Update debian linux to version 6.12.94-1.
  • Update canonical linux-aws-7.0 to version 7.0.0-1010.10~24.04.1.
  • Update canonical linux to version 7.0.0-29.29.
  • Update canonical linux-aws to version 7.0.0-1010.10.
  • Update canonical linux-azure to version 7.0.0-1011.11.
  • Update canonical linux-azure-fde to version 7.0.0-1010.10.
  • Update canonical linux-ibm to version 7.0.0-1011.11.
  • Update canonical linux-oem-7.0 to version 7.0.0-1010.10.
  • Update canonical linux-oracle to version 7.0.0-1009.9.
  • Update canonical linux-raspi to version 7.0.0-1016.16.
  • Update canonical linux-realtime to version 7.0.0-29.29.1.
  • Update canonical linux-riscv to version 7.0.0-29.29.1.
  • Update debian linux to version 7.0.13-1.
  • Update bellsoft linux-lts to version 6.12.95-r0.
  • Update bellsoft linux-lts to version 6.18.38-r0.
  • Update canonical linux-aws-6.8 to version 6.8.0-1063.66~22.04.1.
  • Update canonical linux-azure-6.8 to version 6.8.0-1065.73~22.04.1.
  • Update canonical linux-azure-fde-6.8 to version 6.8.0-1064.71~22.04.1.
  • Update canonical linux-gcp-6.8 to version 6.8.0-1066.74~22.04.1.
  • Update canonical linux-hwe-6.8 to version 6.8.0-138.138~22.04.1.
  • Update canonical linux-ibm-6.8 to version 6.8.0-1063.64~22.04.1.
  • Update canonical linux-lowlatency-hwe-6.8 to version 6.8.0-138.138.1~22.04.1.
  • Update canonical linux-nvidia-6.8 to version 6.8.0-1061.64~22.04.1.
  • Update canonical linux-oracle-6.8 to version 6.8.0-1060.63~22.04.1.
  • Update canonical linux-riscv-6.8 to version 6.8.0-138.138~22.04.1.
  • Update canonical linux-realtime-6.8 to version 6.8.1-1058.59~22.04.1.
  • Update canonical linux to version 6.8.0-138.138.
  • Update canonical linux-aws to version 6.8.0-1063.66.
  • Update canonical linux-azure to version 6.8.0-1065.73.
  • Update canonical linux-azure-fde to version 6.8.0-1064.71.
  • Update canonical linux-gcp to version 6.8.0-1066.74.
  • Update canonical linux-gke to version 6.8.0-1061.69.
  • Update canonical linux-gkeop to version 6.8.0-1048.52.
  • Update canonical linux-hwe-7.0 to version 7.0.0-29.29~24.04.2.
  • Update canonical linux-ibm to version 6.8.0-1063.64.
  • Update canonical linux-lowlatency to version 6.8.0-138.138.1.
  • Update canonical linux-nvidia to version 6.8.0-1061.64.
  • Update canonical linux-nvidia-7.0 to version 7.0.0-1016.16~24.04.1.
  • Update canonical linux-nvidia-lowlatency to version 6.8.0-1061.64.1.
  • Update canonical linux-nvidia-tegra to version 6.8.0-1032.34.
  • Update canonical linux-oracle to version 6.8.0-1060.63.
  • Update canonical linux-raspi to version 6.8.0-1063.67.
  • Update canonical linux-riscv-7.0 to version 7.0.0-30.30.1~24.04.1.
  • Update canonical linux-xilinx to version 6.8.0-1035.36.
  • Update canonical linux-aws-fips to version 6.8.0-1063.66+fips1.
  • Update canonical linux-azure-fips to version 6.8.0-1065.73+fips1.
  • Update canonical linux-fips to version 6.8.0-138.138+fips1.
  • Update canonical linux-gcp-fips to version 6.8.0-1066.74+fips1.
  • Update canonical linux-raspi-realtime to version 6.8.0-2052.54.
  • Update canonical linux-realtime to version 6.8.1-1058.59.
  • Update canonical linux-gcp to version 7.0.0-1010.10.
  • Update canonical linux-gke to version 7.0.0-1005.6.
  • Update canonical linux-nvidia to version 7.0.0-1016.16.
  • Update canonical linux-nvidia-bos to version 7.0.0-2016.16.
  • Update canonical linux to version 6.8.0-138.138.aikido.86.
  • Update canonical rootio-linux to version 6.8.0-138.138.aikido.86.
  • Update canonical linux-azure-7.0 to version 7.0.0-1014.14~24.04.1.
  • Update canonical linux-gcp-7.0 to version 7.0.0-1011.11~24.04.1.
  • Update canonical linux-nvidia-6.17 to version 6.17.0-1032.32.
  • Update canonical linux-oracle-7.0 to version 7.0.0-1011.11~24.04.1.
  • Update canonical linux-bluefield to version 6.8.0-1029.34.
  • Update linux to version 6.8.0-146.146.aikido.89.
  • Update rootio-linux to version 6.8.0-146.146.aikido.89.
  • Update canonical linux-oem-6.17 to version 6.17.0-1033.33.
Affected software
Ecosystem VendorProductAffected versions
Debian:13 debian linux < 6.12.94-1
Fix: upgrade to 6.12.94-1
Debian:14 debian linux < 7.0.13-1
Fix: upgrade to 7.0.13-1
Ubuntu:18.04:LTS canonical linux-hwe-edge All versions
Ubuntu:18.04:LTS canonical linux-oem All versions
Ubuntu:18.04:LTS canonical linux-oracle-5.0 All versions
Ubuntu:18.04:LTS canonical linux-oracle-5.3 All versions
Ubuntu:20.04:LTS canonical linux-aws-5.11 All versions
Ubuntu:20.04:LTS canonical linux-aws-5.13 All versions
Ubuntu:20.04:LTS canonical linux-aws-5.8 All versions
Ubuntu:20.04:LTS canonical linux-azure-5.11 All versions
Ubuntu:20.04:LTS canonical linux-azure-5.13 All versions
Ubuntu:20.04:LTS canonical linux-azure-5.8 All versions
Ubuntu:20.04:LTS canonical linux-azure-fde All versions
Ubuntu:20.04:LTS canonical linux-gcp-5.11 All versions
Ubuntu:20.04:LTS canonical linux-gcp-5.13 All versions
Ubuntu:20.04:LTS canonical linux-gcp-5.8 All versions
Ubuntu:20.04:LTS canonical linux-gke All versions
Ubuntu:20.04:LTS canonical linux-gke-5.15 All versions
Ubuntu:20.04:LTS canonical linux-gkeop All versions
Ubuntu:20.04:LTS canonical linux-gkeop-5.15 All versions
Ubuntu:20.04:LTS canonical linux-hwe-5.11 All versions
Ubuntu:20.04:LTS canonical linux-hwe-5.13 All versions
Ubuntu:20.04:LTS canonical linux-hwe-5.8 All versions
Ubuntu:20.04:LTS canonical linux-intel-5.13 All versions
Ubuntu:20.04:LTS canonical linux-oem-5.10 All versions
Ubuntu:20.04:LTS canonical linux-oem-5.13 All versions
Ubuntu:20.04:LTS canonical linux-oem-5.14 All versions
Ubuntu:20.04:LTS canonical linux-oem-5.6 All versions
Ubuntu:20.04:LTS canonical linux-oracle-5.11 All versions
Ubuntu:20.04:LTS canonical linux-oracle-5.13 All versions
Ubuntu:20.04:LTS canonical linux-oracle-5.8 All versions
Ubuntu:20.04:LTS canonical linux-raspi2 All versions
Ubuntu:20.04:LTS canonical linux-riscv All versions
Ubuntu:20.04:LTS canonical linux-riscv-5.11 All versions
Ubuntu:20.04:LTS canonical linux-riscv-5.8 All versions
Ubuntu:22.04:LTS canonical linux-allwinner-5.19 All versions
Ubuntu:22.04:LTS canonical linux-aws-5.19 All versions
Ubuntu:22.04:LTS canonical linux-aws-6.2 All versions
Ubuntu:22.04:LTS canonical linux-aws-6.5 All versions
Ubuntu:22.04:LTS canonical linux-aws-6.8 < 6.8.0-1063.66~22.04.1
Fix: upgrade to 6.8.0-1063.66~22.04.1
Ubuntu:22.04:LTS canonical linux-azure-5.19 All versions
Ubuntu:22.04:LTS canonical linux-azure-6.2 All versions
Ubuntu:22.04:LTS canonical linux-azure-6.5 All versions
Ubuntu:22.04:LTS canonical linux-azure-6.8 < 6.8.0-1065.73~22.04.1
Fix: upgrade to 6.8.0-1065.73~22.04.1
Ubuntu:22.04:LTS canonical linux-azure-fde-5.19 All versions
Ubuntu:22.04:LTS canonical linux-azure-fde-6.2 All versions
Ubuntu:22.04:LTS canonical linux-azure-fde-6.8 < 6.8.0-1064.71~22.04.1
Fix: upgrade to 6.8.0-1064.71~22.04.1
Ubuntu:22.04:LTS canonical linux-gcp-5.19 All versions
Ubuntu:22.04:LTS canonical linux-gcp-6.2 All versions
Ubuntu:22.04:LTS canonical linux-gcp-6.5 All versions
Showing 50 of 182. Show the rest
Ecosystem VendorProductAffected versions
Ubuntu:22.04:LTS canonical linux-gcp-6.8 < 6.8.0-1066.74~22.04.1
Fix: upgrade to 6.8.0-1066.74~22.04.1
Ubuntu:22.04:LTS canonical linux-hwe-5.19 All versions
Ubuntu:22.04:LTS canonical linux-hwe-6.2 All versions
Ubuntu:22.04:LTS canonical linux-hwe-6.5 All versions
Ubuntu:22.04:LTS canonical linux-hwe-6.8 < 6.8.0-138.138~22.04.1
Fix: upgrade to 6.8.0-138.138~22.04.1
Ubuntu:22.04:LTS canonical linux-ibm-6.8 < 6.8.0-1063.64~22.04.1
Fix: upgrade to 6.8.0-1063.64~22.04.1
Ubuntu:22.04:LTS canonical linux-intel-iot-realtime All versions
Ubuntu:22.04:LTS canonical linux-lowlatency-hwe-5.19 All versions
Ubuntu:22.04:LTS canonical linux-lowlatency-hwe-6.2 All versions
Ubuntu:22.04:LTS canonical linux-lowlatency-hwe-6.5 All versions
Ubuntu:22.04:LTS canonical linux-lowlatency-hwe-6.8 < 6.8.0-138.138.1~22.04.1
Fix: upgrade to 6.8.0-138.138.1~22.04.1
Ubuntu:22.04:LTS canonical linux-nvidia-6.2 All versions
Ubuntu:22.04:LTS canonical linux-nvidia-6.5 All versions
Ubuntu:22.04:LTS canonical linux-nvidia-6.8 < 6.8.0-1061.64~22.04.1
Fix: upgrade to 6.8.0-1061.64~22.04.1
Ubuntu:22.04:LTS canonical linux-oem-5.17 All versions
Ubuntu:22.04:LTS canonical linux-oem-6.0 All versions
Ubuntu:22.04:LTS canonical linux-oem-6.1 All versions
Ubuntu:22.04:LTS canonical linux-oem-6.5 All versions
Ubuntu:22.04:LTS canonical linux-oracle-6.5 All versions
Ubuntu:22.04:LTS canonical linux-oracle-6.8 < 6.8.0-1060.63~22.04.1
Fix: upgrade to 6.8.0-1060.63~22.04.1
Ubuntu:22.04:LTS canonical linux-realtime All versions
Ubuntu:22.04:LTS canonical linux-riscv All versions
Ubuntu:22.04:LTS canonical linux-riscv-5.19 All versions
Ubuntu:22.04:LTS canonical linux-riscv-6.5 All versions
Ubuntu:22.04:LTS canonical linux-riscv-6.8 < 6.8.0-138.138~22.04.1
Fix: upgrade to 6.8.0-138.138~22.04.1
Ubuntu:22.04:LTS canonical linux-starfive-5.19 All versions
Ubuntu:22.04:LTS canonical linux-starfive-6.2 All versions
Ubuntu:22.04:LTS canonical linux-starfive-6.5 All versions
Ubuntu:Pro:Realtime:22.04:LTS canonical linux-realtime-6.8 < 6.8.1-1058.59~22.04.1
Fix: upgrade to 6.8.1-1058.59~22.04.1
Ubuntu:24.04:LTS canonical linux < 6.8.0-138.138
Fix: upgrade to 6.8.0-138.138
Ubuntu:24.04:LTS canonical linux-aws < 6.8.0-1063.66
Fix: upgrade to 6.8.0-1063.66
Ubuntu:24.04:LTS canonical linux-aws-6.14 All versions
Ubuntu:24.04:LTS canonical linux-aws-6.17 All versions
Ubuntu:24.04:LTS canonical linux-aws-7.0 < 7.0.0-1010.10~24.04.1
Fix: upgrade to 7.0.0-1010.10~24.04.1
Ubuntu:24.04:LTS canonical linux-azure < 6.8.0-1065.73
Fix: upgrade to 6.8.0-1065.73
Ubuntu:24.04:LTS canonical linux-azure-6.11 All versions
Ubuntu:24.04:LTS canonical linux-azure-6.14 All versions
Ubuntu:24.04:LTS canonical linux-azure-6.17 All versions
Ubuntu:24.04:LTS canonical linux-azure-fde < 6.8.0-1064.71
Fix: upgrade to 6.8.0-1064.71
Ubuntu:24.04:LTS canonical linux-azure-fde-6.14 All versions
Ubuntu:24.04:LTS canonical linux-azure-fde-6.17 All versions
Ubuntu:24.04:LTS canonical linux-azure-nvidia All versions
Ubuntu:24.04:LTS canonical linux-azure-nvidia-6.14 All versions
Ubuntu:24.04:LTS canonical linux-gcp < 6.8.0-1066.74
Fix: upgrade to 6.8.0-1066.74
Ubuntu:24.04:LTS canonical linux-gcp-6.11 All versions
Ubuntu:24.04:LTS canonical linux-gcp-6.14 All versions
Ubuntu:24.04:LTS canonical linux-gcp-6.17 All versions
Ubuntu:24.04:LTS canonical linux-gke < 6.8.0-1061.69
Fix: upgrade to 6.8.0-1061.69
Ubuntu:24.04:LTS canonical linux-gkeop < 6.8.0-1048.52
Fix: upgrade to 6.8.0-1048.52
Ubuntu:24.04:LTS canonical linux-hwe-6.11 All versions
Ubuntu:24.04:LTS canonical linux-hwe-6.14 All versions
Ubuntu:24.04:LTS canonical linux-hwe-6.17 All versions
Ubuntu:24.04:LTS canonical linux-hwe-7.0 < 7.0.0-29.29~24.04.2
Fix: upgrade to 7.0.0-29.29~24.04.2
Ubuntu:24.04:LTS canonical linux-ibm < 6.8.0-1063.64
Fix: upgrade to 6.8.0-1063.64
Ubuntu:24.04:LTS canonical linux-lowlatency < 6.8.0-138.138.1
Fix: upgrade to 6.8.0-138.138.1
Ubuntu:24.04:LTS canonical linux-lowlatency-hwe-6.11 All versions
Ubuntu:24.04:LTS canonical linux-nvidia < 6.8.0-1061.64
Fix: upgrade to 6.8.0-1061.64
Ubuntu:24.04:LTS canonical linux-nvidia-6.11 All versions
Ubuntu:24.04:LTS canonical linux-nvidia-6.17 < 6.17.0-1032.32
Fix: upgrade to 6.17.0-1032.32
Ubuntu:24.04:LTS canonical linux-nvidia-7.0 < 7.0.0-1016.16~24.04.1
Fix: upgrade to 7.0.0-1016.16~24.04.1
Ubuntu:24.04:LTS canonical linux-nvidia-lowlatency < 6.8.0-1061.64.1
Fix: upgrade to 6.8.0-1061.64.1
Ubuntu:24.04:LTS canonical linux-nvidia-tegra < 6.8.0-1032.34
Fix: upgrade to 6.8.0-1032.34
Ubuntu:24.04:LTS canonical linux-oem-6.11 All versions
Ubuntu:24.04:LTS canonical linux-riscv All versions
Ubuntu:24.04:LTS canonical linux-riscv-6.14 All versions
Ubuntu:24.04:LTS canonical linux-riscv-6.17 All versions
Ubuntu:24.04:LTS canonical linux-xilinx < 6.8.0-1035.36
Fix: upgrade to 6.8.0-1035.36
Ubuntu:Nvidia-BlueField:24.04:LTS canonical linux-bluefield < 6.8.0-1029.34
Fix: upgrade to 6.8.0-1029.34
Ubuntu:Pro:FIPS-updates:24.04:LTS canonical linux-aws-fips < 6.8.0-1063.66+fips1
Fix: upgrade to 6.8.0-1063.66+fips1
Ubuntu:Pro:FIPS-updates:24.04:LTS canonical linux-azure-fips < 6.8.0-1065.73+fips1
Fix: upgrade to 6.8.0-1065.73+fips1
Ubuntu:Pro:FIPS-updates:24.04:LTS canonical linux-fips < 6.8.0-138.138+fips1
Fix: upgrade to 6.8.0-138.138+fips1
Ubuntu:Pro:FIPS-updates:24.04:LTS canonical linux-gcp-fips < 6.8.0-1066.74+fips1
Fix: upgrade to 6.8.0-1066.74+fips1
Ubuntu:Pro:Realtime:24.04:LTS canonical linux-raspi-realtime < 6.8.0-2052.54
Fix: upgrade to 6.8.0-2052.54
Ubuntu:Pro:Realtime:24.04:LTS canonical linux-realtime < 6.8.1-1058.59
Fix: upgrade to 6.8.1-1058.59
Ubuntu:Pro:Realtime:24.04:LTS canonical linux-realtime-6.14 All versions
Ubuntu:Pro:Realtime:24.04:LTS canonical linux-realtime-6.17 All versions
Ubuntu:25.10 canonical linux All versions
Ubuntu:25.10 canonical linux-aws All versions
Ubuntu:25.10 canonical linux-azure All versions
Ubuntu:25.10 canonical linux-azure-fde All versions
Ubuntu:25.10 canonical linux-gcp All versions
Ubuntu:25.10 canonical linux-oracle All versions
Ubuntu:25.10 canonical linux-raspi All versions
Ubuntu:25.10 canonical linux-realtime All versions
Ubuntu:25.10 canonical linux-riscv All versions
Ubuntu:26.04:LTS canonical linux < 7.0.0-29.29
Fix: upgrade to 7.0.0-29.29
Ubuntu:26.04:LTS canonical linux-aws < 7.0.0-1010.10
Fix: upgrade to 7.0.0-1010.10
Ubuntu:26.04:LTS canonical linux-azure < 7.0.0-1011.11
Fix: upgrade to 7.0.0-1011.11
Ubuntu:26.04:LTS canonical linux-azure-fde < 7.0.0-1010.10
Fix: upgrade to 7.0.0-1010.10
Ubuntu:26.04:LTS canonical linux-gcp < 7.0.0-1010.10
Fix: upgrade to 7.0.0-1010.10
Ubuntu:26.04:LTS canonical linux-gke < 7.0.0-1005.6
Fix: upgrade to 7.0.0-1005.6
Ubuntu:26.04:LTS canonical linux-ibm < 7.0.0-1011.11
Fix: upgrade to 7.0.0-1011.11
Ubuntu:26.04:LTS canonical linux-nvidia < 7.0.0-1016.16
Fix: upgrade to 7.0.0-1016.16
Ubuntu:26.04:LTS canonical linux-nvidia-bos < 7.0.0-2016.16
Fix: upgrade to 7.0.0-2016.16
Ubuntu:26.04:LTS canonical linux-oem-7.0 < 7.0.0-1010.10
Fix: upgrade to 7.0.0-1010.10
Ubuntu:26.04:LTS canonical linux-oracle < 7.0.0-1009.9
Fix: upgrade to 7.0.0-1009.9
Ubuntu:26.04:LTS canonical linux-raspi < 7.0.0-1016.16
Fix: upgrade to 7.0.0-1016.16
Ubuntu:26.04:LTS canonical linux-realtime < 7.0.0-29.29.1
Fix: upgrade to 7.0.0-29.29.1
Ubuntu:26.04:LTS canonical linux-riscv < 7.0.0-29.29.1
Fix: upgrade to 7.0.0-29.29.1
Alpaquita:25 bellsoft linux-lts >= 6.12.92-r0, < 6.12.95-r0
Fix: upgrade to 6.12.95-r0
Alpaquita:stream bellsoft linux-lts >= 6.18.35-r1, < 6.18.38-r0
Fix: upgrade to 6.18.38-r0
– linux linux_kernel >= 6.2, < 6.6.143
>= 6.7, < 6.12.94
>= 6.13, < 6.18.36
>= 6.19, < 7.0.13
7.1
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Ubuntu:24.04:LTS canonical linux-azure-7.0 < 7.0.0-1014.14~24.04.1
Fix: upgrade to 7.0.0-1014.14~24.04.1
Ubuntu:24.04:LTS canonical linux-gcp-7.0 < 7.0.0-1011.11~24.04.1
Fix: upgrade to 7.0.0-1011.11~24.04.1
Ubuntu:24.04:LTS canonical linux-oracle < 6.8.0-1060.63
Fix: upgrade to 6.8.0-1060.63
Ubuntu:24.04:LTS canonical linux-oracle-7.0 < 7.0.0-1011.11~24.04.1
Fix: upgrade to 7.0.0-1011.11~24.04.1
Ubuntu:24.04:LTS canonical linux-raspi < 6.8.0-1063.67
Fix: upgrade to 6.8.0-1063.67
Ubuntu:24.04:LTS canonical linux-riscv-7.0 < 7.0.0-30.30.1~24.04.1
Fix: upgrade to 7.0.0-30.30.1~24.04.1
Ubuntu:18.04:LTS canonical linux-hwe All versions
Ubuntu:16.04:LTS canonical linux-hwe-edge All versions
Ubuntu:18.04:LTS canonical linux-aws-5.0 All versions
Ubuntu:18.04:LTS canonical linux-aws-5.3 All versions
Ubuntu:18.04:LTS canonical linux-azure All versions
Ubuntu:18.04:LTS canonical linux-azure-5.3 All versions
Ubuntu:18.04:LTS canonical linux-azure-edge All versions
Ubuntu:18.04:LTS canonical linux-gcp All versions
Ubuntu:18.04:LTS canonical linux-gcp-5.3 All versions
Ubuntu:18.04:LTS canonical linux-gke-4.15 All versions
Ubuntu:18.04:LTS canonical linux-gke-5.4 All versions
Ubuntu:18.04:LTS canonical linux-gkeop-5.4 All versions
Ubuntu:24.04:LTS canonical linux-oem-6.14 All versions
Ubuntu:24.04:LTS canonical linux-oem-6.17 < 6.17.0-1033.33
Fix: upgrade to 6.17.0-1033.33
Ubuntu:24.04:LTS canonical linux-oem-6.8 All versions
Ubuntu:24.04:LTS canonical linux-oracle-6.14 All versions
Ubuntu:24.04:LTS canonical linux-oracle-6.17 All versions
Ubuntu:24.04:LTS canonical linux-raspi-realtime All versions
Ubuntu:24.04:LTS canonical linux-realtime All versions
Root:Ubuntu:24.04 canonical linux < 6.8.0-138.138.aikido.86
Fix: upgrade to 6.8.0-138.138.aikido.86
Root:Ubuntu:24.04 canonical rootio-linux < 6.8.0-138.138.aikido.86
Fix: upgrade to 6.8.0-138.138.aikido.86
Ubuntu:24.04:LTS canonical linux-azure-fde-7.0 All versions
Root:Ubuntu:24.04 – linux < 6.8.0-146.146.aikido.89
Fix: upgrade to 6.8.0-146.146.aikido.89
Root:Ubuntu:24.04 – rootio-linux < 6.8.0-146.146.aikido.89
Fix: upgrade to 6.8.0-146.146.aikido.89
Original advisory text
CVE-2026-53247 in linux - Patched by Root
In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, a use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.8 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-416Use After Free
Timeline
Published25 Jun 2026
Updated9 Oct 2026
First seen25 Jun 2026
Track software like this
Free during beta