ACK/Cmnt: [SRU][Q/N][PATCH 0/2] CVE-2026-53247

[Alessio Faina]

On Fri, Jul 17, 2026 at 06:22:20PM +0300, Cengiz Can via kernel-team wrote:
> https://ubuntu.com/security/CVE-2026-53247
> 
> [ Impact ]
> 
> The mtk_eth_soc driver frees a metadata_dst via metadata_dst_free(), which
> calls kfree() immediately and bypasses the RCU grace period. In the RX path,
> skb_dst_set_noref() installs a non-refcounted pointer from the skb to that
> metadata_dst, which must remain valid until all RCU readers complete. Because
> the driver tears down the dst without waiting for the RCU grace period, a use-
> after-free can occur if an skb still holds a noref pointer to the dst. This is
> a high-severity flaw (CVSS 9.8) that can lead to memory corruption.
> 
> [ Fix ]
> 
> questing: backported with AI-assisted adaptation
> noble: backported with AI-assisted adaptation
> 
> [ Test Plan ]
> 
> Boot tested.
> 
> [ Where Problems Could Occur ]
> 
> An incorrect fix in the mtk_eth_soc networking driver could cause dst refcount
> imbalances, leading to memory leaks or premature frees during RX processing on
> affected MediaTek Ethernet hardware.
> 
> -- 
> kernel-team mailing list
> kernel-team at lists.ubuntu.com
> https://lists.ubuntu.com/mailman/listinfo/kernel-team

Small note, these are cherry-picks and not backports as the only
difference is the offset.
The small mistake is both in the cover and in the submission themselves so, 
when applied, I'd change it to "cherry-picked with AI-assisted adaptation".

Acked-by: Alessio Faina <alessio.faina at canonical.com>