In the Linux kernel, the following vulnerability has been resolved:
net: airoha: Fix use-after-free in metadata dst teardown
airoha_metadata_dst_free() runs metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period. In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This function requires RCU read-side protection and the dst must remain valid until all RCU readers complete. Since metadata_dst_free() calls kfree() directly, an use-after-free can occur if any skb still holds a noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release() which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Ubuntu | — | Upgrade linux-image-gke-hwe-26.04Upgrade linux-image-7.0.0-31-genericUpgrade linux-image-realtime-64k-7.0Upgrade linux-image-oracleUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-gke-64k-hwe-26.04Upgrade linux-image-virtual-7.0Upgrade linux-image-realtimeUpgrade linux-image-7.0.0-1011-oracleUpgrade linux-image-gke-7.0Upgrade linux-image-realtime-64kUpgrade linux-image-generic-hwe-26.04Upgrade linux-image-awsUpgrade linux-image-7.0.0-1018-nvidia-64kUpgrade linux-image-azure-7.0Upgrade linux-image-7.0.0-1014-azureUpgrade linux-image-oracle-64k-7.0Upgrade linux-image-oem-7.0Upgrade linux-image-virtualUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-7.0.0-1012-aws-64kUpgrade linux-image-gke-64kUpgrade linux-image-gcp-64k-7.0Upgrade linux-image-7.0.0-1018-nvidiaUpgrade linux-image-gcp-7.0Upgrade linux-image-raspi-7.0Upgrade linux-image-generic-7.0Upgrade linux-image-7.0.0-31-realtimeUpgrade linux-image-7.0.0-1012-awsUpgrade linux-image-generic-64k-7.0Upgrade linux-image-virtual-hwe-24.04Upgrade linux-image-raspiUpgrade linux-image-nvidiaUpgrade linux-image-aws-64k-7.0Upgrade linux-image-7.0.0-1013-oemUpgrade linux-image-raspi-realtime-7.0Upgrade linux-image-azure-lts-26.04Upgrade linux-image-7.0.0-1011-oracle-64kUpgrade linux-image-realtime-hwe-26.04Upgrade linux-image-nvidia-hwe-26.04Upgrade linux-image-7.0.0-1019-raspiUpgrade linux-image-realtime-7.0Upgrade linux-image-generic-64k-hwe-26.04Upgrade linux-image-7.0.0-1019-raspi-realtimeUpgrade linux-image-realtime-64k-hwe-26.04Upgrade linux-image-7.0.0-1011-gcp-64kUpgrade linux-image-7.0.0-1006-gkeUpgrade linux-image-oem-26.04bUpgrade linux-image-raspi-realtimeUpgrade linux-image-nvidia-64k-7.0Upgrade linux-image-azureUpgrade linux-image-oem-26.04Upgrade linux-image-nvidia-bos-7.0Upgrade linux-image-7.0.0-1013-ibmUpgrade linux-image-nvidia-bosUpgrade linux-image-nvidia-7.0Upgrade linux-image-ibm-7.0Upgrade linux-image-ibmUpgrade linux-image-gkeUpgrade linux-image-generic-64kUpgrade linux-image-genericUpgrade linux-image-7.0.0-1006-gke-64kUpgrade linux-image-7.0.0-31-generic-64kUpgrade linux-image-7.0.0-1011-gcpUpgrade linux-image-virtual-hwe-26.04Upgrade linux-image-oracle-64kUpgrade linux-image-gcpUpgrade linux-image-aws-64kUpgrade linux-image-7.0.0-31-realtime-64kUpgrade linux-image-gcp-64kUpgrade linux-image-7.0.0-2018-nvidia-bosUpgrade linux-image-gke-64k-7.0Upgrade linux-image-nvidia-64k-hwe-26.04Upgrade linux-image-nvidia-64kUpgrade linux-image-oracle-7.0Upgrade linux-image-oem-26.04aUpgrade linux-image-nvidia-bos-64k-7.0Upgrade linux-image-nvidia-bos-64kUpgrade linux-image-aws-7.0Upgrade linux-image-7.0.0-2018-nvidia-bos-64k | Sep 14, 2026 | Sep 7, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub