201 lines
11 KiB
JSON
201 lines
11 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2026-53247",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2026-06-09T07:44:35.394Z",
|
|
"datePublished": "2026-06-25T08:39:40.654Z",
|
|
"dateUpdated": "2026-08-05T12:34:31.498Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-08-05T12:34:31.498Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown\n\nmtk_free_dev() calls metadata_dst_free() which frees the metadata_dst\nwith kfree() immediately, bypassing the RCU grace period.\nIn the RX path, skb_dst_set_noref() sets a non-refcounted pointer from\nthe skb to the metadata_dst. This function requires RCU read-side\nprotection and the dst must remain valid until all RCU readers complete.\nSince metadata_dst_free() calls kfree() directly, a use-after-free can\noccur if any skb still holds a noref pointer to the dst when the driver\ntears it down.\nReplace metadata_dst_free() with dst_release() which properly goes\nthrough the refcount path: when the refcount drops to zero, it schedules\nthe actual free via call_rcu_hurry(), ensuring all RCU readers have\ncompleted before the memory is freed."
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"baseScore": 9.8,
|
|
"baseSeverity": "CRITICAL"
|
|
},
|
|
"scenarios": [
|
|
{
|
|
"lang": "en",
|
|
"value": "AV:N - Packets received on the affected MediaTek Ethernet/DSA data path can cause skbs to carry the vulnerable non-refcounted metadata dst. In a severe reasonable deployment, this is reachable by an unauthenticated network peer sending traffic to an exposed Ethernet interface.\nAC:L - The RX path reliably assigns the metadata dst under the DSA hardware untagging conditions, and the bug is a straightforward lifetime violation during teardown. Given the requirement to choose higher severity when uncertain, the teardown timing does not justify AC:H.\nPR:N - The attacker needs no credentials to send packets that enter the affected RX path and populate skbs with the stale metadata pointer. Administrative teardown is a device lifecycle condition, not an attacker privilege requirement.\nUI:N - No victim user must open a file or perform a protocol-level action for malicious packets to enter the vulnerable path. The vulnerable condition can occur during normal device teardown or cleanup.\nS:U - The corruption occurs within the same kernel security authority as the affected network driver and networking stack. There is no guest-to-host, IOMMU, or separate-scope boundary crossing.\nC:H - This is a kernel use-after-free of a metadata_dst object referenced from skbs. Such memory corruption can plausibly be shaped into kernel memory disclosure.\nI:H - A kernel use-after-free can plausibly be exploited through heap reuse to corrupt controlled kernel objects or hijack control/data flow. Under the required higher-severity rule, integrity impact is High.\nA:H - The stale dst pointer can be dereferenced by GRO/DSA/network stack processing after immediate kfree. Even without full exploitation, this can cause kernel oops or panic."
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"drivers/net/ethernet/mediatek/mtk_eth_soc.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "2d7605a729062bb554f03c5983d8cfb8c0b42e9c",
|
|
"lessThan": "72775977e89c25c99ee84d2c5baa3f86a8ba5cb4",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "2d7605a729062bb554f03c5983d8cfb8c0b42e9c",
|
|
"lessThan": "459c6f35c58cf0fd5247e55d73ddaa29571d9b7e",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "2d7605a729062bb554f03c5983d8cfb8c0b42e9c",
|
|
"lessThan": "e634408d2b0cd939cfe019398a21fb47b7a8ffe3",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "2d7605a729062bb554f03c5983d8cfb8c0b42e9c",
|
|
"lessThan": "2d86aeb46d5f69c704065a8c69822582787272a1",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "2d7605a729062bb554f03c5983d8cfb8c0b42e9c",
|
|
"lessThan": "80df409e1a483676826a6c66e693dba6ac507751",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"drivers/net/ethernet/mediatek/mtk_eth_soc.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "6.2",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "6.2",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.6.143",
|
|
"lessThanOrEqual": "6.6.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.12.94",
|
|
"lessThanOrEqual": "6.12.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.18.36",
|
|
"lessThanOrEqual": "6.18.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "7.0.13",
|
|
"lessThanOrEqual": "7.0.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "7.1",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.2",
|
|
"versionEndExcluding": "6.6.143"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.2",
|
|
"versionEndExcluding": "6.12.94"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.2",
|
|
"versionEndExcluding": "6.18.36"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.2",
|
|
"versionEndExcluding": "7.0.13"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.2",
|
|
"versionEndExcluding": "7.1"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/72775977e89c25c99ee84d2c5baa3f86a8ba5cb4"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/459c6f35c58cf0fd5247e55d73ddaa29571d9b7e"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/e634408d2b0cd939cfe019398a21fb47b7a8ffe3"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/2d86aeb46d5f69c704065a8c69822582787272a1"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/80df409e1a483676826a6c66e693dba6ac507751"
|
|
}
|
|
],
|
|
"title": "net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
}
|
|
}
|
|
} |