CVE-2026-74548

HighCVSS 7.8

Published: 15/08/2026(UTC)Updated: 19/08/2026(UTC)Translated: 15/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.13%

3th percentile - higher than 3% of all known CVEs

Summary

In the Linux kernel, the forcedeth driver has a use-after-free vulnerability in nv_remove(), where per-CPU txrx_stats are freed before unregistering the network device, potentially leading to access to freed memory. The fix moves the free after unregister_netdev().

Risk Assessment

A local attacker can trigger a system crash or potentially execute code in kernel context by invoking network operations during driver removal.

Recommendation

Install the kernel patch that frees the stats only after unregistering the network device.

Original NVD description (English source)

In the Linux kernel, the following vulnerability has been resolved: forcedeth: fix UAF of txrx_stats in nv_remove nv_remove() frees the per-CPU txrx_stats before unregister_netdev(). Until unregister completes, ndo_get_stats64, the NAPI/xmit data path, and nv_close()/drain may still access txrx_stats, leading to a use-after-free. Free the stats only after unregister_netdev().