CVE-2026-53234

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

net: ibm: emac: Fix use-after-free during device removal

The driver was using devm_register_netdev() which causes unregister_netdev()

to be deferred until the devres cleanup phase, which runs after emac_remove()

returns. This creates a use-after-free window where:

1. emac_remove() is called, which tears down hardware (cancels work, detaches

modules, unregisters from MAL)

2. emac_remove() returns

3. devres cleanup runs and finally calls unregister_netdev()

During step 3, the network stack might still process packets, triggering

emac_irq(), emac_poll(), or other handlers that access now-freed hardware

resources (dev->emacp, dev->mal, etc.).

Fix this by replacing devm_register_netdev() with manual register_netdev()

and calling unregister_netdev() at the beginning of emac_remove(), before

any hardware teardown. This ensures the network device is fully stopped and

unregistered before hardware resources are released.

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References