CVE-2026-53248

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: airoha: Fix use-after-free in metadata dst teardown

airoha_metadata_dst_free() runs metadata_dst_free() which frees the

metadata_dst with kfree() immediately, bypassing the RCU grace period.

In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from

the skb to the metadata_dst. This function requires RCU read-side

protection and the dst must remain valid until all RCU readers complete.

Since metadata_dst_free() calls kfree() directly, an use-after-free can

occur if any skb still holds a noref pointer to the dst when the driver

tears it down.

Replace metadata_dst_free() with dst_release() which properly goes

through the refcount path: when the refcount drops to zero, it schedules

the actual free via call_rcu_hurry(), ensuring all RCU readers have

completed before the memory is freed.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References