CVE-2026-74548
Received Received - Intake

Use-After-Free in Linux Kernel forcedeth Driver

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: forcedeth: fix UAF of txrx_stats in nv_remove nv_remove() frees the per-CPU txrx_stats before unregister_netdev(). Until unregister completes, ndo_get_stats64, the NAPI/xmit data path, and nv_close()/drain may still access txrx_stats, leading to a use-after-free. Free the stats only after unregister_netdev().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-15
Last Modified
2026-08-15
Generated
2026-08-15
AI Q&A
2026-08-15
EPSS Evaluated
N/A
NVD
CVE-2026-74548
EUVD
EUVD-2026-59741

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux_kernel linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free (UAF) vulnerability in the Linux kernel's forcedeth network driver. The issue occurs in the nv_remove() function, which frees the per-CPU txrx_stats structure before unregistering the network device. This allows the NAPI/xmit data path, ndo_get_stats64, and nv_close()/drain to still access the freed memory, causing a use-after-free condition.

Detection Guidance

This vulnerability involves a use-after-free in the forcedeth driver's txrx_stats during device removal. Detection requires checking for kernel logs or crashes related to forcedeth or network device unloading. Commands like dmesg | grep forcedeth or journalctl -k | grep forcedeth may reveal issues. Ensure your kernel is updated to a patched version.

Impact Analysis

This vulnerability could lead to system crashes, kernel memory corruption, or potential privilege escalation if exploited. Attackers might trigger the UAF to execute arbitrary code in the kernel context, compromising the entire system.

Mitigation Strategies

Apply the latest kernel update from your distribution to patch the forcedeth driver. Avoid unloading network drivers unnecessarily. Monitor system logs for forcedeth-related errors. If affected, reboot the system to ensure the patched kernel is active.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74548. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart