[SRU][N:hwe-6.17/N:hwe-6.17][PATCH 0/2] CVE-2026-53212

[Cengiz Can]

https://ubuntu.com/security/CVE-2026-53212

[ Impact ]

nft_tunnel_obj_destroy() called metadata_dst_free(), which kfree()s the
metadata_dst directly and ignores the dst_entry refcount. Packets that took
a reference via dst_hold() in nft_tunnel_obj_eval() and are still queued
(for example in a netem qdisc) are left with a dangling pointer; when they
are dequeued, dst_release() operates on freed memory. Configuring nft
tunnel objects requires CAP_NET_ADMIN.

[ Fix ]

noble/linux-hwe-6.17: clean cherry-pick

[ Test Plan ]

Build tested only (CBD).

[ Where Problems Could Occur ]

The change is confined to the object destroy path in
net/netfilter/nft_tunnel.c, replacing metadata_dst_free() with
dst_release(). An error could leak the metadata_dst; this is a clean pick
of the upstream fix with no adaptation.