CVE-2026-74545

Received Received - Intake

Double Free in Linux Kernel rtase Driver

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: rtase: fix double free of multi-frag skb on DMA map failure In rtase_start_xmit(), when the head buffer DMA mapping fails after rtase_xmit_frags() has mapped all fragments, the error path clears the fragment descriptors with rtase_tx_clear_range(), which frees the skb through the last-frag slot and accounts tx_dropped. Control then falls through to the common error label, which frees the same skb a second time and counts it again. Return right after clearing the fragments when the skb owns frags; the no-frag case still drops through and frees the head skb once.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-74545

EUVD

EUVD-2026-59738

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a double free of a multi-fragment socket buffer (skb) when DMA mapping fails. In the rtase_start_xmit() function, if the head buffer DMA mapping fails after mapping all fragments, the error path incorrectly clears fragment descriptors, freeing the skb once. Then, the common error label frees the same skb again, causing a double free and incorrect accounting of dropped packets.

Detection Guidance

This vulnerability involves a double free in the Linux kernel's rtase driver during DMA mapping failures. Detection requires checking for kernel logs or crashes related to rtase or network driver errors. Monitor system logs for messages like 'double free' or 'skb freed' in rtase-related contexts. Use commands like 'dmesg | grep rtase' or 'journalctl -k | grep -i double\\s*free' to search for relevant errors.

Impact Analysis

This vulnerability could lead to kernel memory corruption, crashes, or system instability due to the double free of skb structures. It may cause unexpected behavior, data loss, or denial of service if exploited or triggered under specific network conditions.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it is a Linux kernel memory management issue causing a double free of network buffers. Compliance impact would depend on how the affected system is used, but the vulnerability itself is unrelated to data protection or privacy requirements.

Mitigation Strategies

Update the Linux kernel to the patched version that resolves this double free vulnerability in the rtase driver. Monitor system logs for signs of skb double free errors or unexpected skb drops.

Hi! I’m here to help you understand CVE-2026-74545. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70