Skip to main content

Linux Kernel CVE-2026-53247

| EUVDEUVD-2026-39198 CRITICAL
Use After Free (CWE-416)
2026-06-25 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-mm4j-fwqr-3cf4
Authentication Bypass Linux Use After Free Memory Corruption Red Hat Suse
Critical
Disputed · 9.8 Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Sources disagree (Medium–Critical)
Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
4.7 MEDIUM

Teardown is admin-triggered (PR:H) and the bug is a hard-to-win race on local MediaTek hardware (AV:L/AC:H); impact is mainly a kernel crash (A:H) with only incidental memory corruption (I:L) and no info disclosure (C:N).

3.1 AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H
4.0 AV:L/AC:H/AT:P/PR:H/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jun 28, 2026 - 09:43 vuln.today
CVSS changed
Jun 28, 2026 - 08:22 NVD
9.8 (CRITICAL)
Patch available
Jun 25, 2026 - 10:32 EUVD
CVE Published
Jun 25, 2026 - 09:16 cve.org
UNKNOWN (no severity yet)
CVE Published
Jun 25, 2026 - 09:16 cve.org
CRITICAL 9.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown

mtk_free_dev() calls metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, a use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed.

AnalysisAI

Memory corruption (use-after-free) in the Linux kernel's MediaTek mtk_eth_soc Ethernet driver allows the metadata destination object to be freed via kfree() during driver teardown while the RX path may still hold a non-refcounted (noref) pointer to it from a live skb. Affects systems running the mtk_eth_soc driver (MediaTek SoC networking, common in routers/embedded devices) across multiple kernel branches; the fix routes the free through dst_release() so the RCU grace period is honored. No public exploit identified at time of analysis, EPSS is low (0.18%, 8th percentile), and it is not in CISA KEV - despite the input's nominal CVSS of 9.8.

Technical ContextAI

The root cause is a classic CWE-416 use-after-free arising from an RCU lifetime mismatch. In the kernel networking stack, skb_dst_set_noref() attaches a non-reference-counted pointer to a metadata_dst (a lightweight tunnel/metadata destination used for hardware offload) onto received packets, relying on RCU read-side protection so the object stays valid until all readers finish. The buggy mtk_free_dev() teardown path called metadata_dst_free(), which invokes kfree() synchronously and bypasses the RCU grace period, so memory could be reclaimed while an in-flight skb in the RX path still referenced it. The corrected path uses dst_release(), which decrements the refcount and, on reaching zero, defers the actual free via call_rcu_hurry() so all RCU readers complete first. The affected component is the mtk_eth_soc driver for MediaTek Ethernet SoCs, not the generic kernel core. CWE is reported as N/A in the input but maps cleanly to CWE-416 (Use After Free).

RemediationAI

Vendor-released patch: update to a fixed stable kernel - 6.6.143, 6.12.94, 6.18.36, 7.0.13, or 7.1 (or later on each branch), or apply the corresponding stable commits (e.g., 2d86aeb46d5f69c704065a8c69822582787272a1, 459c6f35c58cf0fd5247e55d73ddaa29571d9b7e, 72775977e89c25c99ee84d2c5baa3f86a8ba5cb4, 80df409e1a483676826a6c66e693dba6ac507751, e634408d2b0cd939cfe019398a21fb47b7a8ffe3 at https://git.kernel.org/stable/c/). The fix replaces metadata_dst_free() with dst_release() so freeing respects the RCU grace period. There is no clean configuration workaround since the bug is in core driver teardown; the practical compensating control is to avoid repeated/unnecessary down-up or remove-probe cycles of the MediaTek interface under load, which narrows the race window but does not eliminate it and is not a substitute for patching. On embedded/router platforms, obtain the fixed firmware/kernel image from the device vendor or OpenWrt rather than patching in place.

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-53247 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy