CVE-2026-74548 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
forcedeth: fix UAF of txrx_stats in nv_remove
nv_remove() frees the per-CPU txrx_stats before unregister_netdev(). Until unregister completes, ndo_get_stats64, the NAPI/xmit data path, and nv_close()/drain may still access txrx_stats, leading to a use-after-free.
Free the stats only after unregister_netdev().
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability in question relates to a use-after-free condition within the forcedeth network driver of the Linux kernel, specifically affecting the handling of per-CPU statistics during device removal. This issue stems from improper ordering of resource deallocation operations during the network device shutdown process, creating a window where active references to freed memory can persist.
The technical flaw occurs in the nv_remove function where the driver attempts to free the txrx_stats structure before completing the network device unregistering process. This sequence creates a race condition where multiple kernel subsystems may still attempt to access the freed statistics structure through various pathways including the ndo_get_stats64 callback function, NAPI polling mechanisms, xmit data paths, and the nv_close or drain functions. The underlying cause aligns with CWE-416, which describes use-after-free vulnerabilities that occur when memory is accessed after it has been freed by the same program.
The operational impact of this vulnerability extends beyond simple memory corruption, potentially enabling privilege escalation or system instability. Attackers could exploit this condition to trigger undefined behavior through controlled network traffic patterns, leading to denial of service or in severe cases, arbitrary code execution within kernel space. The vulnerability affects systems utilizing the forcedeth driver with multiple CPU configurations where per-CPU statistics structures are utilized, making it particularly relevant for server and workstation environments running Linux kernels with this specific network driver implementation.
The remediation approach requires reordering the resource cleanup operations to ensure that unregister_netdev() completes entirely before allowing txrx_stats to be freed. This solution follows established best practices for kernel memory management and prevents the race condition by ensuring all active references are terminated prior to deallocation. The fix aligns with ATT&CK technique T1068 by addressing a kernel-level vulnerability that could enable privilege escalation, and demonstrates proper resource lifecycle management principles consistent with secure coding standards. This vulnerability highlights the importance of careful synchronization in multi-threaded kernel environments where multiple subsystems may simultaneously access shared resources during device lifecycle transitions. The fix represents a fundamental correction to memory management ordering that prevents potential exploitation through controlled network packet injection or system stress conditions that might trigger concurrent access patterns to the freed statistics structure.