ACK: [SRU][N:hwe-6.17/N:hwe-6.17][PATCH 0/2] CVE-2026-53212

[Alessio Faina]

On Wed, Jul 22, 2026 at 08:02:43PM +0300, Cengiz Can via kernel-team wrote:
> https://ubuntu.com/security/CVE-2026-53212
> 
> [ Impact ]
> 
> nft_tunnel_obj_destroy() called metadata_dst_free(), which kfree()s the
> metadata_dst directly and ignores the dst_entry refcount. Packets that took
> a reference via dst_hold() in nft_tunnel_obj_eval() and are still queued
> (for example in a netem qdisc) are left with a dangling pointer; when they
> are dequeued, dst_release() operates on freed memory. Configuring nft
> tunnel objects requires CAP_NET_ADMIN.
> 
> [ Fix ]
> 
> noble/linux-hwe-6.17: clean cherry-pick
> 
> [ Test Plan ]
> 
> Build tested only (CBD).
> 
> [ Where Problems Could Occur ]
> 
> The change is confined to the object destroy path in
> net/netfilter/nft_tunnel.c, replacing metadata_dst_free() with
> dst_release(). An error could leak the metadata_dst; this is a clean pick
> of the upstream fix with no adaptation.
> 
> -- 
> kernel-team mailing list
> kernel-team at lists.ubuntu.com
> https://lists.ubuntu.com/mailman/listinfo/kernel-team

Acked-by: Alessio Faina <alessio.faina at canonical.com>