Executive brief
A vulnerability in the Linux kernel's Airoha Ethernet driver could allow a local user to cause a system crash. The issue occurs when the system incorrectly handles memory during network data processing, leading to a 'use-after-free' condition. This primarily impacts the stability and availability of systems using Airoha networking hardware.
Technical details
A use-after-free vulnerability exists in the airoha_eth driver within the Linux kernel. The function airoha_metadata_dst_free() incorrectly calls metadata_dst_free(), which immediately invokes kfree() and bypasses the necessary RCU grace period. In the receive (RX) path, skb_dst_set_noref() creates non-refcounted pointers to this metadata; if the driver tears down the destination while these pointers are still in use by RCU readers, a use-after-free occurs. The fix replaces the immediate free with dst_release(), which utilizes proper reference counting and schedules memory reclamation via call_rcu_hurry() only after all readers have finished.
Affected products
- Linux Linux 6.15 to 6.18.35, 7.0 to 7.0.12
Timeline
- 2026-06-02: other: Patch authored
- 2026-06-25: disclosed: CVE published