APPLIED: [SRU][N:hwe-6.17/N:hwe-6.17][PATCH 0/2] CVE-2026-53212

[Edoardo Canepa]

Applied to n:linux/hwe-6.17-next. Thanks.

On 7/22/26 19:02, Cengiz Can via kernel-team wrote:
> https://ubuntu.com/security/CVE-2026-53212
>
> [ Impact ]
>
> nft_tunnel_obj_destroy() called metadata_dst_free(), which kfree()s the
> metadata_dst directly and ignores the dst_entry refcount. Packets that took
> a reference via dst_hold() in nft_tunnel_obj_eval() and are still queued
> (for example in a netem qdisc) are left with a dangling pointer; when they
> are dequeued, dst_release() operates on freed memory. Configuring nft
> tunnel objects requires CAP_NET_ADMIN.
>
> [ Fix ]
>
> noble/linux-hwe-6.17: clean cherry-pick
>
> [ Test Plan ]
>
> Build tested only (CBD).
>
> [ Where Problems Could Occur ]
>
> The change is confined to the object destroy path in
> net/netfilter/nft_tunnel.c, replacing metadata_dst_free() with
> dst_release(). An error could leak the metadata_dst; this is a clean pick
> of the upstream fix with no adaptation.
>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_0x20F88172E14F6784.asc
Type: application/pgp-keys
Size: 3167 bytes
Desc: OpenPGP public key
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20260723/b4c667e7/attachment.key>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 840 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20260723/b4c667e7/attachment.sig>