An update of the linux package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown mtk_free_dev() calls     metadata_dst_free() which frees the metadata_dst with kfree() immediately, bypassing the RCU grace period.
    In the RX path, skb_dst_set_noref() sets a non-refcounted pointer from the skb to the metadata_dst. This     function requires RCU read-side protection and the dst must remain valid until all RCU readers complete.
    Since metadata_dst_free() calls kfree() directly, a use-after-free can occur if any skb still holds a     noref pointer to the dst when the driver tears it down. Replace metadata_dst_free() with dst_release()     which properly goes through the refcount path: when the refcount drops to zero, it schedules the actual     free via call_rcu_hurry(), ensuring all RCU readers have completed before the memory is freed.
    (CVE-2026-53247)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Published	Updated	Severity
322944	Photon OS 5.0: Linux PHSA-2026-5.0-0895	Nessus	PhotonOS Local Security Checks	6/26/2026	8/1/2026	high
323383	Linux Distros Unpatched Vulnerability : CVE-2026-53247	Nessus	Misc.	6/28/2026	7/25/2026	critical

Detections

Analytics

Plugins Search

high

critical