CVE-2026-53247: Linux Kernel Use-After-Free Vulnerability

CVE-2026-53247 Overview

CVE-2026-53247 is a use-after-free vulnerability in the Linux kernel's MediaTek Ethernet System-on-Chip (SoC) driver (mtk_eth_soc). The flaw resides in the metadata destination (metadata_dst) teardown path. When mtk_free_dev() releases driver resources, it invokes metadata_dst_free(), which calls kfree() immediately and bypasses the Read-Copy-Update (RCU) grace period. Receive-path code that uses skb_dst_set_noref() may still hold non-refcounted pointers to the freed object, creating a window for use-after-free access during packet processing on affected MediaTek-based networking hardware.

Critical Impact
A use-after-free in the receive path of the mtk_eth_soc driver can lead to kernel memory corruption, denial of service, or potential local privilege escalation on systems using MediaTek Ethernet controllers.

Affected Products

Linux kernel builds containing the drivers/net/ethernet/mediatek/mtk_eth_soc driver
Networking devices and embedded systems using MediaTek Ethernet SoC controllers
Distributions shipping pre-patch kernels referenced by the upstream stable commits

Discovery Timeline

2026-06-25 - CVE-2026-53247 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-53247

Vulnerability Analysis

The vulnerability is a classic use-after-free [CWE-416] caused by mismatched memory lifetime semantics between allocator teardown and RCU-protected readers. The MediaTek Ethernet driver registers a metadata_dst object used to tag inbound packets with hardware metadata. During device teardown, the driver releases this object synchronously via metadata_dst_free(), which calls kfree() directly on the structure.

In parallel, the receive (RX) hot path attaches the metadata_dst to each socket buffer (skb) using skb_dst_set_noref(). That helper installs a non-refcounted pointer and relies on the destination remaining valid for the duration of the RCU read-side critical section. If teardown frees the object while any in-flight skb still references it, subsequent dereferences read freed memory.

Exploitation requires triggering the driver unregistration path concurrently with active packet reception, producing kernel memory corruption or crashes.

Root Cause

The root cause is the use of metadata_dst_free() in mtk_free_dev(). This function deallocates the structure immediately rather than deferring the free until all RCU readers complete. The fix replaces the call with dst_release(), which decrements the refcount and, when it reaches zero, defers the actual free through call_rcu_hurry(). This guarantees all RCU readers exit their critical sections before memory is reclaimed.

Attack Vector

The attack vector is local and requires the ability to trigger driver teardown or device unbinding while traffic is being processed. An attacker with sufficient privileges to unload the driver, or a fault condition that forces teardown during high RX load, can race the free with RX completion handlers and corrupt kernel memory.

No public proof-of-concept exploit is associated with this CVE. See the upstream patches for technical details: Kernel Commit 2d86aeb, Kernel Commit 459c6f3, Kernel Commit 7277597, Kernel Commit 80df409, and Kernel Commit e634408.

Detection Methods for CVE-2026-53247

Indicators of Compromise

Kernel oops or panic logs referencing mtk_eth_soc, metadata_dst, skb_dst, or dst_release call paths.
KASAN (Kernel Address Sanitizer) reports flagging use-after-free reads in receive completion routines on MediaTek hardware.
Unexpected driver unbind, rebind, or rmmod/modprobe events on mtk_eth_soc while interfaces carry traffic.

Detection Strategies

Audit installed kernel versions against the upstream stable commits listed in this advisory to identify unpatched systems.
Enable KASAN on test or canary devices to surface latent use-after-free conditions in the MediaTek driver path.
Correlate dmesg output and crash dumps with networking subsystem stack frames involving metadata_dst_free or mtk_free_dev.

Monitoring Recommendations

Centralize kernel logs from MediaTek-based appliances and alert on BUG:, KASAN:, or general protection fault entries.
Track module load and unload events for mtk_eth_soc through auditd or equivalent kernel audit tooling.
Monitor host availability and packet-processing anomalies on affected embedded devices, including unexpected reboots or interface resets.

How to Mitigate CVE-2026-53247

Immediate Actions Required

Update affected Linux kernels to a version that includes the upstream fix replacing metadata_dst_free() with dst_release() in mtk_free_dev().
Inventory all MediaTek-based networking devices, routers, and embedded Linux systems in scope and prioritize patching those exposed to untrusted users.
Restrict local access and the ability to unload kernel modules to administrative accounts only.

Patch Information

The fix is available across multiple stable branches via the following upstream commits: Kernel Commit 2d86aeb, Kernel Commit 459c6f3, Kernel Commit 7277597, Kernel Commit 80df409, and Kernel Commit e634408. The patch ensures the metadata destination is released through the refcounted path so that call_rcu_hurry() defers the free until all RCU readers complete.

Workarounds

Avoid manual unbind or unload operations on the mtk_eth_soc driver on production systems until patches are deployed.
Where feasible, disable or restrict features that drive heavy metadata destination usage on the RX path during planned maintenance windows.
Apply vendor firmware or distribution kernel updates from device manufacturers that incorporate the upstream stable patches.

bash

# Verify the running kernel and inspect MediaTek Ethernet driver status
uname -r
modinfo mtk_eth_soc | grep -E 'filename|version|srcversion'
# Restrict module unload to root only and audit unload attempts
auditctl -w /sbin/rmmod -p x -k kernel_module_unload