Skip to main content

Linux Kernel CVE-2026-53248

| EUVDEUVD-2026-39199 HIGH
Use After Free (CWE-416)
2026-06-25 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-83pq-fmf8-563q
Authentication Bypass Linux Use After Free Memory Corruption Red Hat Suse
8.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
8.8 HIGH
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

Triggered by a privileged, timing-dependent teardown race local to the host, so AV:L/AC:H/PR:L; a kernel UAF can yield disclosure, corruption, and crash, so C/I/A:H.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
7.0 HIGH
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jun 28, 2026 - 09:43 vuln.today
CVSS changed
Jun 28, 2026 - 08:22 NVD
8.8 (HIGH)
Patch available
Jun 25, 2026 - 10:32 EUVD
CVE Published
Jun 25, 2026 - 09:16 cve.org
UNKNOWN (no severity yet)
CVE Published
Jun 25, 2026 - 09:16 cve.org
HIGH 8.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

net: airoha: Fix use-after-free in metadata dst teardown

airoha_metadata_dst_free() runs metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, an use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed.

AnalysisAI

Use-after-free in the Linux kernel's Airoha (airoha_eth) network driver allows memory corruption when metadata dst objects are torn down while still referenced by in-flight receive skbs. The airoha_metadata_dst_free() routine called metadata_dst_free()/kfree() directly, bypassing the RCU grace period required by the noref dst pointers set via skb_dst_set_noref() in the RX path, so RCU readers could dereference freed memory. No public exploit identified at time of analysis, and EPSS is low (0.18%, 8th percentile); the issue is patched in current stable kernels.

Technical ContextAI

The affected component is the airoha_eth driver, which serves the integrated Gigabit Ethernet/packet engine on Airoha (formerly MediaTek) EN7581-class networking SoCs. The bug is a classic CWE-416 (use-after-free) arising from inconsistent memory-reclamation semantics: the RX path uses skb_dst_set_noref() to attach a non-refcounted pointer to a metadata_dst, which mandates RCU read-side protection and requires the dst to survive until all concurrent readers finish. The teardown path instead freed the object synchronously with kfree(), violating that contract. The fix replaces metadata_dst_free() with dst_release(), which decrements the refcount and, on reaching zero, defers the actual free through call_rcu_hurry() so that all outstanding RCU readers complete first. The input lists CWE as N/A, but the root cause is unambiguously a use-after-free / RCU lifetime violation.

RemediationAI

Apply the vendor kernel update: upgrade to a stable Linux release containing the fix (patched branches indicated around 6.18.36, 7.0.13, and 7.1), which replaces the synchronous metadata_dst_free()/kfree() with the RCU-safe dst_release() path - see the stable commits 4b5a574e033e66d2131eff1c18feef8d8643c67e, b38cae85d1c45ff189d7ecb6ac36f41cdc3d84d0, and 6f829e2c17a53a35321268339cd252aff6d6d723 at git.kernel.org/stable and the advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-53248. There is no in-driver toggle to disable the vulnerable code; the only true fix is the patched kernel. As a compensating control on devices that cannot be updated immediately, avoid operations that trigger driver teardown/reconfiguration under load (avoid repeated airoha interface down/up or module reload while traffic is flowing), since the UAF is reached during dst teardown; the trade-off is reduced operational flexibility (no live reconfiguration) without eliminating the underlying race. Restricting which accounts can manage network interfaces/modules (root/CAP_NET_ADMIN) further limits who can drive the teardown path.

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected

Share

CVE-2026-53248 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy