CVE-2026-53247: Linux kernel mtk_eth_soc use-after-free in metadata dst teardown
A use-after-free (CWE-416) in the mtk_eth_soc Ethernet driver of the Linux kernel can occur when a metadata dst is freed immediately instead of after the RCU grace period. The CNA-assigned CVSS 3.1 base score is 9.8 (Critical), and the record links five stable-tree patch commits. The sources consulted show no confirmed exploitation.
Overview
The record describes a use-after-free (CWE-416) in the mtk_eth_soc Ethernet driver of the Linux kernel. During teardown, the driver frees a metadata dst immediately instead of letting the reference-count release path wait for RCU readers to finish. According to the record, the fix replaces that direct free with dst_release().
Impact
- The CNA-assigned CVSS 3.1 base score is 9.8 (Critical), with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. This describes network attack vector, low complexity, no privileges, no user interaction, and high impact to confidentiality, integrity and availability.
- Use-after-free conditions can lead to memory corruption. The specific consequences in this driver are unknown from the sources consulted.
Affected products and versions
The record lists the Linux kernel as the affected product, with these ranges:
- From 6.2 up to, but not including, 6.6.143
- From 6.7 up to, but not including, 6.12.94
- From 6.13 up to, but not including, 6.18.36
- From 6.19 up to, but not including, 7.0.13
- Versions 7.1-rc1 through 7.1-rc6 (release candidates)
The record does not state fixed version numbers explicitly. Because the listed ranges end at the versions above, stable branches appear to have received the fix at those points (inference). Check your distribution or vendor kernel package, since backports may differ.
Exploitation status
The record shows that this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog, and no EPSS score is provided. No confirmed exploitation appears in the sources consulted. This reflects the limits of the available information and does not prove that exploitation does not occur.
Remediation and mitigation
- Update the Linux kernel to a stable release that includes the upstream fix for your branch. The record references these commits: commit 80df409e, commit 72775977, commit e634408d, commit 459c6f35 and commit 2d86aeb4.
- Prefer vendor or distribution kernel builds that document this fix, because backports are applied per branch.
- If the mtk_eth_soc driver is not needed on a system, consider disabling it as a hardening step. This does not replace patching.
Detection guidance
- Inventory systems that run affected kernel branches and that use MediaTek Ethernet hardware.
- If kernel memory-safety tooling is enabled in your environment, monitor logs for reports from the network stack. The absence of such reports does not prove a system is safe.
- Review change records to confirm that deployed kernel builds include the referenced stable commits.
Limitations of the available information
- The record does not include a vendor-specific advisory, a distribution-level list of fixed versions, or details on the conditions needed to trigger the flaw.
- The impact on specific devices and distributions is unknown.
- Whether the issue is reachable in practice is not established by the record. The CVSS vector comes from the CNA and is the only severity indication provided.
Frequently asked questions
Is this vulnerability known to be actively exploited?
The record shows it is not listed in the CISA KEV catalog and provides no EPSS score. No confirmed exploitation appears in the sources consulted.
Which component is affected?
The mtk_eth_soc Ethernet driver in the Linux kernel, according to the record.
What should administrators do?
Apply a kernel build that includes the upstream fix for your branch, and confirm with your distribution or vendor whether it is backported.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.