ACK: [SRU][Q/N][PATCH 0/2] CVE-2026-53247

[Tim Whisonant]

On Fri, Jul 17, 2026 at 06:22:20PM +0300, Cengiz Can via kernel-team wrote:
> https://ubuntu.com/security/CVE-2026-53247
> 
> [ Impact ]
> 
> The mtk_eth_soc driver frees a metadata_dst via metadata_dst_free(), which
> calls kfree() immediately and bypasses the RCU grace period. In the RX path,
> skb_dst_set_noref() installs a non-refcounted pointer from the skb to that
> metadata_dst, which must remain valid until all RCU readers complete. Because
> the driver tears down the dst without waiting for the RCU grace period, a use-
> after-free can occur if an skb still holds a noref pointer to the dst. This is
> a high-severity flaw (CVSS 9.8) that can lead to memory corruption.
> 
> [ Fix ]
> 
> questing: backported with AI-assisted adaptation
> noble: backported with AI-assisted adaptation
> 
> [ Test Plan ]
> 
> Boot tested.
> 
> [ Where Problems Could Occur ]
> 
> An incorrect fix in the mtk_eth_soc networking driver could cause dst refcount
> imbalances, leading to memory leaks or premature frees during RX processing on
> affected MediaTek Ethernet hardware.
> 

Acked-by: Tim Whisonant <tim.whisonant at canonical.com>