CVE-2026-53247: 
Chainguard vulnerability analysis and mitigation

CVE-2026-53247 is a use-after-free vulnerability in the Linux kernel's Mediatek Ethernet driver (net/ethernet/mtk_eth_soc) affecting the metadata destination teardown path. The flaw was disclosed on June 25, 2026, and affects Linux kernel versions starting from 6.2 up to (but not including) the patched stable releases. Fixed versions include 6.6.143, 6.12.94, 6.18.36, 7.0.13, and 7.1. It carries a CVSS v3.1 base score of 9.8 (Critical) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-825 (Expired Pointer Dereference). In mtk_free_dev(), metadata_dst_free() is called to release the metadata_dst structure using kfree() directly, which bypasses the RCU (Read-Copy-Update) grace period. During packet reception, skb_dst_set_noref() sets a non-refcounted pointer from the socket buffer (skb) to the metadata_dst; this function requires RCU read-side protection and the destination must remain valid until all RCU readers complete. If any in-flight skb still holds a noref pointer to the metadata_dst when the driver tears it down, a use-after-free occurs. The fix replaces metadata_dst_free() with dst_release(), which properly manages the refcount and schedules deallocation via call_rcu_hurry() to ensure all RCU readers have finished before memory is freed (GitHub Advisory).

Successful exploitation can result in kernel memory corruption, leading to a system crash (denial of service) or potentially arbitrary code execution in kernel context. An unauthenticated network attacker can trigger the condition by sending crafted Ethernet packets that race with driver teardown, causing the kernel to access already-freed memory. The vulnerability affects confidentiality, integrity, and availability at the highest level per CVSS scoring, though the primary observed impact is denial of service via kernel panic (GitHub Advisory, Red Hat Bugzilla).

Update to a patched Linux kernel version: 6.6.143, 6.12.94, 6.18.36, 7.0.13, or 7.1 and later. Distribution-specific kernel security updates (e.g., from Red Hat) should be applied as soon as available. No configuration-based workaround has been published; upgrading the kernel is the only recommended remediation (GitHub Advisory, Red Hat Bugzilla).

A Reddit thread in r/linux noted this CVE as part of an unusually long list of 9.8-scoring CVEs published on the same day, reflecting community surprise at the high CVSS score for what is primarily a driver-level kernel bug (Reddit). Red Hat has acknowledged the vulnerability via its Bugzilla tracker and is tracking it for affected products (Red Hat Bugzilla). The Yocto Project security mailing list also flagged the issue for embedded Linux maintainers.