CVE-2026-53247: net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown

Synopsis

A use-after-free vulnerability exists in the Linux kernel's MediaTek Ethernet driver (mtk_eth_soc). The flaw is reachable over the network with no authentication required, and affects systems where the driver tears down a metadata destination structure without honoring the RCU (Read-Copy-Update) grace period, leaving dangling pointers accessible to concurrent RCU readers in the receive path. Successful exploitation gives an attacker full read, write, and denial-of-service capability over the affected system. Patched kernel versions 6.6.143 and 6.12.94 are available, and a patched-image rebuild is available on HarborGuard for environments running an affected kernel version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the affected service over the network; the CVSS vector specifies AV:N, meaning no local or physical access is required.

• AuthenticationNot required

  No credentials or prior account access are needed; the CVSS vector specifies PR:N.

• Victim interactionNot required

  Exploitation requires no action from any user or operator on the target system; the CVSS vector specifies UI:N.

• Attack complexityDetail

  Attack complexity is rated Low (AC:L), meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other hard-to-control environmental factors.

Blast Radius

• An attacker who triggers the use-after-free can read arbitrary kernel memory, exposing cryptographic keys, session tokens, and other sensitive data held in kernel structures.
• The write primitive obtained through the freed memory region allows modification of kernel data structures, enabling privilege escalation or injection of attacker-controlled code paths.
• The driver can be crashed by corrupting freed memory, taking down the network interface and any workloads depending on it.
• Because the flaw lives in the kernel receive path, a remote attacker sending crafted network traffic can repeatedly trigger the condition without requiring a foothold on the host.