vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2026-74548

forcedeth: fix UAF of txrx_stats in nv_remove

HIGH
7.8
CVSS Score
Published: August 15, 2026 at 12:27 PM UTC
Updated: October 16, 2026 at 08:17 PM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
HIGH7.8
Exploit prediction
EPSS 0.1%
SSVC
No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: forcedeth: fix UAF of txrx_stats in nv_remove nv_remove() frees the per-CPU txrx_stats before unregister_netdev(). Until unregister completes, ndo_get_stats64, the NAPI/xmit data path, and nv_close()/drain may still access txrx_stats, leading to a use-after-free. Free the stats only after unregister_netdev().

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel· Linux
90%
5.3f4b633b911fd3b4cbe1dc065e8fb064078d0889d
Vendor states this is fixed in 201e05aa531eba0dfe2ee05b4e178f6ffa12c8b1 (fixed)
Vendor states this is fixed in 22666ba1420164753d7b0f5a841986b25ace5435 (fixed)
Vendor states this is fixed in 7c22b4ee0bd003cecfc14ca28981cb213e201f70 (fixed)
Vendor states this is fixed in ae20a8a4de06a289d40b0a0633d8d573f1fcb049 (fixed)
Vendor states this is fixed in c9d24a205fd508b9999fcab6aca4c590490a12cf (fixed)
Vendor states this is fixed in cdf864d5d3c813ae1876f2bacc1cf3ac3c66dfc9 (fixed)
Vendor states this is fixed in cf2dcde2284562ff87830ca0b7fa2b06e95aef1e (fixed)
Vendor states this is fixed in d51ce7a63b76eda02cabfed1b0cc277b2f5c9bcc (fixed)
Vendor states this is fixed in 5.10.265 (unaffected)
Vendor states this is fixed in 5.15.216 (unaffected)
Vendor states this is fixed in 5.3 (unaffected)
Vendor states this is fixed in 6.1.183 (unaffected)
Vendor states this is fixed in 6.12.103 (unaffected)
Vendor states this is fixed in 6.18.44 (unaffected)
Vendor states this is fixed in 6.6.151 (unaffected)
Vendor states this is fixed in 7.1.8 (unaffected)
Vendor states this is fixed in 7.2 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

References (8)

Source: cverecord
https://git.kernel.org/stable/c/cf2dcde2284562ff87830ca0b7fa2b06e95aef1e
Source: cverecord
https://git.kernel.org/stable/c/c9d24a205fd508b9999fcab6aca4c590490a12cf
Source: cverecord
https://git.kernel.org/stable/c/ae20a8a4de06a289d40b0a0633d8d573f1fcb049
Source: cverecord
https://git.kernel.org/stable/c/201e05aa531eba0dfe2ee05b4e178f6ffa12c8b1
Source: cverecord
https://git.kernel.org/stable/c/22666ba1420164753d7b0f5a841986b25ace5435
Source: cverecord
https://git.kernel.org/stable/c/cdf864d5d3c813ae1876f2bacc1cf3ac3c66dfc9
Source: cverecord
https://git.kernel.org/stable/c/7c22b4ee0bd003cecfc14ca28981cb213e201f70
Source: cverecord
https://git.kernel.org/stable/c/d51ce7a63b76eda02cabfed1b0cc277b2f5c9bcc

SSVC — Action Prioritization

SSVCNo known exploitNot automatableTotal impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

7.8HIGHLinux
Vector?

Quick Info

StatusRECEIVED

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card