[SRU][Q/N][PATCH 0/2] CVE-2026-53247

[Cengiz Can]

https://ubuntu.com/security/CVE-2026-53247

[ Impact ]

The mtk_eth_soc driver frees a metadata_dst via metadata_dst_free(), which
calls kfree() immediately and bypasses the RCU grace period. In the RX path,
skb_dst_set_noref() installs a non-refcounted pointer from the skb to that
metadata_dst, which must remain valid until all RCU readers complete. Because
the driver tears down the dst without waiting for the RCU grace period, a use-
after-free can occur if an skb still holds a noref pointer to the dst. This is
a high-severity flaw (CVSS 9.8) that can lead to memory corruption.

[ Fix ]

questing: backported with AI-assisted adaptation
noble: backported with AI-assisted adaptation

[ Test Plan ]

Boot tested.

[ Where Problems Could Occur ]

An incorrect fix in the mtk_eth_soc networking driver could cause dst refcount
imbalances, leading to memory leaks or premature frees during RX processing on
affected MediaTek Ethernet hardware.