CVE-2026-53212: Linux Kernel Netfilter Tunnel Use-After-Free Vulnerability (CVSS 7.8)

Technical summary

CVE-2026-53212 is a use-after-free (CWE-416) flaw in nft_tunnel_obj_destroy() within the Linux kernel's netfilter subsystem. The function calls metadata_dst_free() to directly kfree() the metadata_dst structure while ignoring the dst_entry reference count. During normal packet processing in nft_tunnel_obj_eval(), packets call dst_hold() to increment the reference count. If these packets remain queued in network disciplines (e.g., netem) when the tunnel object is destroyed, they retain dangling pointers to freed memory. Subsequent dst_release() calls on dequeued packets operate on freed memory, causing a use-after-free condition. The remediation replaces metadata_dst_free() with dst_release(), allowing the dst subsystem to properly manage cleanup when the DST_METADATA flag is set and the reference count reaches zero.

Business impact

This vulnerability enables denial of service attacks on Linux systems running affected kernel versions. A local attacker with limited privileges can trigger the use-after-free condition, resulting in kernel panic and system unavailability. The HIGH severity rating reflects local attack surface, but the impact—complete loss of system availability—is critical for production environments. Systems relying on netfilter-based tunneling for network policy enforcement face operational risk until patched. No direct data confidentiality or integrity breach is evident, but kernel exploitation could theoretically lead to privilege escalation.

Affected systems

The Linux kernel is affected across multiple stable and development versions. The vulnerability specifically impacts systems using the netfilter tunnel (nft_tunnel) module, which is common in network policy, packet filtering, and tunneling setups. Distributions shipping recent kernel versions without this specific fix are vulnerable. Verify your kernel version against the official Linux kernel security advisories and your distribution's patch status.

Exploitability

This vulnerability requires local system access (non-remote) and is triggered through standard network packet processing. The attack vector involves queuing packets in a network discipline such as netem and then triggering tunnel object destruction, causing the use-after-free when packets are dequeued. While not trivial, the requirements (local access, ability to queue packets and destroy objects) are achievable by unprivileged users on systems where netfilter tunneling is enabled. The condition is reliably reproducible under specific timing, making exploitation practical. The vulnerability is not currently tracked in the CISA Known Exploited Vulnerabilities (KEV) catalog.

Remediation

Update to a Linux kernel version that includes the fix for CVE-2026-53212. The remediation involves replacing the metadata_dst_free() call with dst_release(), ensuring proper reference counting and memory management through the dst subsystem. Verify the specific patched kernel version against your distribution's security advisories and kernel release notes. For systems unable to immediately patch, disable or restrict netfilter tunnel functionality if operationally feasible.

Patch guidance

Apply the latest kernel security update from your Linux distribution. Confirm that the patch date (or kernel version inclusion date) is on or after the vulnerability publish date (2026-06-25). Kernel maintainers typically backport fixes to stable and LTS branches; verify against your specific branch (e.g., 6.1.x, 6.6.x, 6.9.x, or mainline). Test the patched kernel in a staging environment to ensure no regression in netfilter or tunnel functionality before production deployment. Coordinate patching with your scheduled maintenance windows and consider kexec or live kernel patching if available in your distribution.

Detection guidance

Monitor kernel logs for BUG, KASAN (Kernel Address Sanitizer), or memory corruption warnings related to metadata_dst or dst_release operations. Network monitoring tools tracking tunnel object lifecycle events may reveal abnormal destruction patterns. Test environments with netem or similar traffic discipline tools can reproduce the condition; use CONFIG_KASAN=y builds to catch use-after-free violations early. Host-based intrusion detection should flag kernel crash events and unexpected system reboots potentially triggered by the vulnerability.

Why prioritize this

Prioritize this vulnerability HIGH due to its local denial-of-service impact, direct kernel memory safety violation, and the prevalence of netfilter in production environments. Although remote exploitation is not possible, the ability to crash the entire kernel from an unprivileged account poses significant availability risk. Prompt patching is essential for production systems.

Risk score, explained

The CVSS 3.1 score of 7.8 reflects a HIGH severity local attack requiring limited privileges, no user interaction, and no scope boundary crossing. The vulnerability directly impacts system availability (A:H) and potential integrity (I:H) through kernel exploitation, with confidentiality exposure (C:H) possible through memory disclosure. The access complexity is low (AC:L) because standard network packet handling can trigger the condition. This score appropriately ranks the risk as significant for production systems despite the local-only attack vector.

Frequently asked questions