PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-74548 Linux CVE debrief

A use-after-free vulnerability exists in the Linux kernel's forcedeth driver. The vulnerability occurs when the `nv_remove` function frees the per-CPU `txrx_stats` before unregistering the network device. This can lead to a use-after-free condition when `ndo_get_stats64`, the NAPI/xmit data path, or `nv_close()/drain` access `txrx_stats` after it has been freed.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-15
Original CVE updated
2026-10-16
Advisory published
2026-08-15
Advisory updated
2026-10-16

Who should care

Linux system administrators and security teams should be aware of this vulnerability and take steps to verify and mitigate it. They should prioritize verifying the Linux kernel version and applying the fix to prevent exploitation of this vulnerability. Additionally, they should review compensating controls for exposed systems while remediation is scheduled and verified, and monitor system for potential crashes or instability.

Why it matters

This vulnerability can lead to a use-after-free condition in the Linux kernel's forcedeth driver, potentially causing system crashes or instability. Linux system administrators and security teams should prioritize verifying the Linux kernel version and applying the fix to prevent exploitation.

  • Verify Linux kernel version to determine exposure
  • Apply fix to prevent use-after-free condition
  • Monitor system for potential crashes or instability

Technical summary

The Linux kernel's forcedeth driver has a use-after-free vulnerability. The `nv_remove` function frees the per-CPU `txrx_stats` before unregistering the network device, leading to a potential use-after-free condition. This vulnerability can cause system crashes or instability if exploited. Linux system administrators and security teams should prioritize verifying the Linux kernel version and applying the fix to prevent exploitation of this vulnerability. The CVE record and source item provide details about the vulnerability, including its description and affected versions.

Defensive priority

Linux system administrators and security teams should prioritize verifying the Linux kernel version and applying the fix to prevent exploitation of this vulnerability.

Recommended defensive actions

  • Verify Linux kernel version and apply the fix
  • Unregister network device before freeing per-CPU txrx_stats
  • Monitor system for potential use-after-free conditions
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details about the vulnerability, including its description and affected versions. However, the corpus does not establish specific exploitation or impact details, requiring verification from official sources.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-74548 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-74548

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-74548 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-74548

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • forcedeth: fix UAF of txrx_stats in nv_remove

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/74xxx/CVE-2026-74548.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/cdf864d5d3c813ae1876f2bacc1cf3ac3c66dfc9

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/7c22b4ee0bd003cecfc14ca28981cb213e201f70

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/d51ce7a63b76eda02cabfed1b0cc277b2f5c9bcc

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/cf2dcde2284562ff87830ca0b7fa2b06e95aef1e

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/c9d24a205fd508b9999fcab6aca4c590490a12cf

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/ae20a8a4de06a289d40b0a0633d8d573f1fcb049

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/201e05aa531eba0dfe2ee05b4e178f6ffa12c8b1

    Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.