CVE-2026-53234: net: ibm: emac: Fix use-after-free during device removal
In the Linux kernel, the following vulnerability has been resolved:
net: ibm: emac: Fix use-after-free during device removal
The driver was using devmregisternetdev() which causes unregisternetdev() to be deferred until the devres cleanup phase, which runs after emacremove() returns. This creates a use-after-free window where:
1. emacremove() is called, which tears down hardware (cancels work, detaches modules, unregisters from MAL) 2. emacremove() returns 3. devres cleanup runs and finally calls unregisternetdev()
During step 3, the network stack might still process packets, triggering emacirq(), emacpoll(), or other handlers that access now-freed hardware resources (dev->emacp, dev->mal, etc.).
Fix this by replacing devmregisternetdev() with manual registernetdev() and calling unregisternetdev() at the beginning of emacremove(), before any hardware teardown. This ensures the network device is fully stopped and unregistered before hardware resources are released.
The change is safe because: - dev->ndev is assigned very early in probe (before any error paths that could bypass emacremove) - platformsetdrvdata() is only called after successful registration, so emacremove() only runs for fully registered devices - unregisternetdev() is idempotent and safe to call on any registered device
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Replace devm_register_netdev() with manual register_netdev() so that unregister_netdev() is not deferred to the devres cleanup phase after emac_remove() has begun teardown.
Linux kernel driver: net: ibm: emac devm_register_netdev() = replace_with_register_netdev()
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems running the Linux kernel IBM EMAC driver are exposed when an affected EMAC network device is removed. The issue is local-only according to the CVSS vector and requires low privileges.
What must happen for exploitation or impact to occur?
The EMAC device removal path must run while the network stack can still process packets. After hardware teardown begins, packet processing can invoke interrupt, polling, or related handlers that access released EMAC or MAL resources.
Are default configurations known to be affected?
The provided information does not establish whether the IBM EMAC driver is enabled or used by default. Exposure depends on the affected driver being present and an EMAC device undergoing removal.
What mitigation is available if the fix cannot be applied immediately?
No alternative mitigation is specified. Reducing or avoiding removal of affected EMAC devices would avoid the described device-removal race condition.
How can I determine whether a system may be affected?
Check whether the running Linux kernel includes and uses the IBM EMAC driver, and whether affected network devices are removed. The relevant unsafe behavior is registration through devm_register_netdev() with unregistration deferred until devres cleanup after emac_remove() returns.