CVE-2026-53212: Linux Kernel Use-After-Free Vulnerability

CVE-2026-53212 Overview

CVE-2026-53212 is a use-after-free vulnerability in the Linux kernel's netfilter nft_tunnel subsystem. The flaw resides in nft_tunnel_obj_destroy(), which calls metadata_dst_free() to directly kfree() the metadata_dst structure while ignoring the dst_entry refcount. Packets that previously took a reference via dst_hold() in nft_tunnel_obj_eval() and remain queued, such as in a netem qdisc, are left holding dangling pointers. When those packets are later dequeued, dst_release() operates on freed memory. The fix replaces metadata_dst_free() with dst_release() so the metadata_dst is freed only after all references are dropped.

Critical Impact
A use-after-free on queued packets referencing a freed metadata_dst can lead to kernel memory corruption, potentially enabling local privilege escalation or denial of service.

Affected Products

Linux kernel (mainline) containing the netfilter nft_tunnel object implementation
Linux stable branches receiving the backported fixes referenced in the kernel.org commits
Distributions shipping the affected kernel revisions prior to applying the upstream patches

Discovery Timeline

2026-06-25 - CVE-2026-53212 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-53212

Vulnerability Analysis

The vulnerability exists in the Linux netfilter nftables tunnel object handling code. When a tunnel object is evaluated against a packet in nft_tunnel_obj_eval(), the kernel attaches the object's metadata_dst to the skb and increments the destination entry refcount via dst_hold(). The reference may persist beyond the immediate transmit path when the packet is queued in qdiscs such as netem, which can hold packets for delayed delivery.

During nftables object teardown, nft_tunnel_obj_destroy() invokes metadata_dst_free(). This helper directly frees the metadata_dst via kfree() without consulting the refcount, dropping the allocation while outstanding dst_hold() references remain. Any queued packet referencing the freed metadata becomes a dangling pointer, and the subsequent dst_release() performed during packet processing dereferences and decrements freed memory.

Root Cause

The root cause is improper lifetime management of a reference-counted object. metadata_dst_free() bypasses the standard refcount-based teardown that dst_release() performs. The dst subsystem already handles metadata_dst cleanup inside dst_destroy() when DST_METADATA is set, so refcounted release is the correct path. This is a classic [CWE-416] Use After Free condition.

Attack Vector

Exploitation requires the ability to configure nftables rules with tunnel objects, typically requiring CAP_NET_ADMIN within a namespace, combined with packet flow through a queueing discipline that delays transmission. A local attacker who can create network namespaces and configure nftables and qdiscs can race object destruction against queued packet dequeuing to trigger the use-after-free. The freed memory may be reclaimed and reallocated, producing kernel memory corruption that can be steered toward privilege escalation or kernel panic.

No public proof-of-concept exploit is associated with this CVE at the time of publication. See the referenced kernel commits, including Kernel Commit 349df61 Fix and Kernel Commit f9a0e4b6 Fix, for technical details.

Detection Methods for CVE-2026-53212

Indicators of Compromise

Kernel oops or panic messages referencing dst_release, metadata_dst, or nft_tunnel in dmesg or /var/log/kern.log
KASAN use-after-free reports naming nft_tunnel_obj_destroy or metadata_dst_free in the call stack on instrumented kernels
Unexpected kernel crashes correlated with nftables rule changes involving tunnel objects on hosts using netem or other delay qdiscs

Detection Strategies

Inventory running kernel versions across Linux hosts and compare against the patched commits published on kernel.org for each stable branch
Audit nftables rulesets for tunnel object definitions and identify hosts that combine nft tunnel objects with queueing disciplines such as netem, tbf, or codel
Enable KASAN in test environments to surface use-after-free conditions during nftables teardown workflows

Monitoring Recommendations

Forward kernel logs to a centralized log platform and alert on BUG:, KASAN:, and general protection fault events involving netfilter symbols
Monitor auditd for nft command executions and namespace creation events that could indicate exploitation attempts by unprivileged users with delegated capabilities
Track changes to loaded kernel modules and nftables tables on production systems to detect anomalous tunnel object lifecycle activity

How to Mitigate CVE-2026-53212

Immediate Actions Required

Apply the upstream kernel patches that replace metadata_dst_free() with dst_release() in nft_tunnel_obj_destroy() once available from your distribution
Restrict CAP_NET_ADMIN and unprivileged user namespace creation on multi-tenant or shared Linux systems to reduce the attack surface
Identify hosts using nftables tunnel objects in combination with packet-delaying qdiscs and prioritize them for patching

Patch Information

The fix is committed across multiple Linux stable branches. Relevant commits include Kernel Commit 349df61, Kernel Commit 55b79b1, Kernel Commit 5e9ee18, Kernel Commit 8767fe40, Kernel Commit 941d7394, Kernel Commit c32b26aa, Kernel Commit f9a0e4b6, and Kernel Commit fda6573a. Consult your distribution's security advisories for backported package releases.

Workarounds

Avoid defining nftables tunnel objects on systems that also use packet-delaying queueing disciplines until the kernel patch is deployed
Disable unprivileged user namespaces by setting kernel.unprivileged_userns_clone=0 where supported to limit local attacker reach into namespace-scoped netfilter configuration
Constrain who can load and modify nftables rulesets using Linux capabilities, sudo policies, and SELinux or AppArmor confinement

bash

# Verify running kernel version and check for the fix
uname -r

# Restrict unprivileged user namespaces (Debian/Ubuntu-style sysctl)
echo 'kernel.unprivileged_userns_clone=0' | sudo tee /etc/sysctl.d/99-userns.conf
sudo sysctl --system

# Audit existing nftables tunnel objects
sudo nft list ruleset | grep -A2 'tunnel'