CVE-2026-74548 (GCVE-0-2026-74548)

Vulnerability from cvelistv5 – Published: 2026-08-15 12:27 – Updated: 2026-08-19 16:38
VLAI
Title
forcedeth: fix UAF of txrx_stats in nv_remove
Summary
In the Linux kernel, the following vulnerability has been resolved: forcedeth: fix UAF of txrx_stats in nv_remove nv_remove() frees the per-CPU txrx_stats before unregister_netdev(). Until unregister completes, ndo_get_stats64, the NAPI/xmit data path, and nv_close()/drain may still access txrx_stats, leading to a use-after-free. Free the stats only after unregister_netdev().
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: f4b633b911fd3b4cbe1dc065e8fb064078d0889d , < cdf864d5d3c813ae1876f2bacc1cf3ac3c66dfc9 (git)
Affected: f4b633b911fd3b4cbe1dc065e8fb064078d0889d , < 7c22b4ee0bd003cecfc14ca28981cb213e201f70 (git)
Affected: f4b633b911fd3b4cbe1dc065e8fb064078d0889d , < d51ce7a63b76eda02cabfed1b0cc277b2f5c9bcc (git)
Affected: f4b633b911fd3b4cbe1dc065e8fb064078d0889d , < cf2dcde2284562ff87830ca0b7fa2b06e95aef1e (git)
Affected: f4b633b911fd3b4cbe1dc065e8fb064078d0889d , < c9d24a205fd508b9999fcab6aca4c590490a12cf (git)
Affected: f4b633b911fd3b4cbe1dc065e8fb064078d0889d , < ae20a8a4de06a289d40b0a0633d8d573f1fcb049 (git)
Affected: f4b633b911fd3b4cbe1dc065e8fb064078d0889d , < 201e05aa531eba0dfe2ee05b4e178f6ffa12c8b1 (git)
Affected: f4b633b911fd3b4cbe1dc065e8fb064078d0889d , < 22666ba1420164753d7b0f5a841986b25ace5435 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.3
Unaffected: 0 , < 5.3 (semver)
Unaffected: 5.10.265 , ≤ 5.10.* (semver)
Unaffected: 5.15.216 , ≤ 5.15.* (semver)
Unaffected: 6.1.183 , ≤ 6.1.* (semver)
Unaffected: 6.6.151 , ≤ 6.6.* (semver)
Unaffected: 6.12.103 , ≤ 6.12.* (semver)
Unaffected: 6.18.44 , ≤ 6.18.* (semver)
Unaffected: 7.1.8 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/nvidia/forcedeth.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "cdf864d5d3c813ae1876f2bacc1cf3ac3c66dfc9",
              "status": "affected",
              "version": "f4b633b911fd3b4cbe1dc065e8fb064078d0889d",
              "versionType": "git"
            },
            {
              "lessThan": "7c22b4ee0bd003cecfc14ca28981cb213e201f70",
              "status": "affected",
              "version": "f4b633b911fd3b4cbe1dc065e8fb064078d0889d",
              "versionType": "git"
            },
            {
              "lessThan": "d51ce7a63b76eda02cabfed1b0cc277b2f5c9bcc",
              "status": "affected",
              "version": "f4b633b911fd3b4cbe1dc065e8fb064078d0889d",
              "versionType": "git"
            },
            {
              "lessThan": "cf2dcde2284562ff87830ca0b7fa2b06e95aef1e",
              "status": "affected",
              "version": "f4b633b911fd3b4cbe1dc065e8fb064078d0889d",
              "versionType": "git"
            },
            {
              "lessThan": "c9d24a205fd508b9999fcab6aca4c590490a12cf",
              "status": "affected",
              "version": "f4b633b911fd3b4cbe1dc065e8fb064078d0889d",
              "versionType": "git"
            },
            {
              "lessThan": "ae20a8a4de06a289d40b0a0633d8d573f1fcb049",
              "status": "affected",
              "version": "f4b633b911fd3b4cbe1dc065e8fb064078d0889d",
              "versionType": "git"
            },
            {
              "lessThan": "201e05aa531eba0dfe2ee05b4e178f6ffa12c8b1",
              "status": "affected",
              "version": "f4b633b911fd3b4cbe1dc065e8fb064078d0889d",
              "versionType": "git"
            },
            {
              "lessThan": "22666ba1420164753d7b0f5a841986b25ace5435",
              "status": "affected",
              "version": "f4b633b911fd3b4cbe1dc065e8fb064078d0889d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/nvidia/forcedeth.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.3"
            },
            {
              "lessThan": "5.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.151",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.151",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.103",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nforcedeth: fix UAF of txrx_stats in nv_remove\n\nnv_remove() frees the per-CPU txrx_stats before unregister_netdev().\nUntil unregister completes, ndo_get_stats64, the NAPI/xmit data path,\nand nv_close()/drain may still access txrx_stats, leading to a\nuse-after-free.\n\nFree the stats only after unregister_netdev()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The UAF is opened in nv_remove() during local PCI/driver teardown (sysfs unbind, module unload, or hot-unplug); although NAPI/xmit and stats readers can run concurrently on still-registered netdev traffic, there is no standalone remote path into nv_remove itself.\nAC:L - Once teardown starts, unregister_netdev() deterministically calls nv_close()\u2192nv_drain_tx(), which increments freed txrx_stats when TX skbs remain, and an attacker can also drive the race by timing unbind against stats polling or packet I/O they control.\nPR:L - Privileged teardown opens the window, but unprivileged peers can supply the concurrent netdev access (rtnetlink/sysfs stats via nv_get_stats64, and RX/TX on the still-up interface) that performs the UAF; per CNA driver-removal UAF precedent and the higher-severity tiebreak, PR:L.\nUI:N - No separate victim action is required beyond routine driver removal or module unload on a live interface; monitoring daemons and network traffic can hit the freed stats automatically during the unregister window without user cooperation.\nS:U - Impact is kernel heap corruption and crash/privilege escalation within the host kernel security authority; it does not cross VM, hypervisor, IOMMU, or container sandbox boundaries.\nC:H - The bug is a kmalloc-backed per-CPU UAF: nv_get_stats64 reads freed nv_txrx_stats counters via per_cpu_ptr(), and once the slab is reallocated an attacker can obtain arbitrary kernel memory disclosure.\nI:H - Freed txrx_stats are updated from NAPI/xmit and nv_drain_tx() via __this_cpu_inc/add on attacker-influenced traffic, enabling heap grooming and controlled writes through the dangling per-CPU pointer for code execution.\nA:H - Use-after-free dereferences of txrx_stats during netdev teardown reliably cause kernel oops/panic (as in the fix description), and even unsuccessful exploitation still crashes the system when concurrent RX/TX or drain paths touch freed memory."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:38:39.684Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/cdf864d5d3c813ae1876f2bacc1cf3ac3c66dfc9"
        },
        {
          "url": "https://git.kernel.org/stable/c/7c22b4ee0bd003cecfc14ca28981cb213e201f70"
        },
        {
          "url": "https://git.kernel.org/stable/c/d51ce7a63b76eda02cabfed1b0cc277b2f5c9bcc"
        },
        {
          "url": "https://git.kernel.org/stable/c/cf2dcde2284562ff87830ca0b7fa2b06e95aef1e"
        },
        {
          "url": "https://git.kernel.org/stable/c/c9d24a205fd508b9999fcab6aca4c590490a12cf"
        },
        {
          "url": "https://git.kernel.org/stable/c/ae20a8a4de06a289d40b0a0633d8d573f1fcb049"
        },
        {
          "url": "https://git.kernel.org/stable/c/201e05aa531eba0dfe2ee05b4e178f6ffa12c8b1"
        },
        {
          "url": "https://git.kernel.org/stable/c/22666ba1420164753d7b0f5a841986b25ace5435"
        }
      ],
      "title": "forcedeth: fix UAF of txrx_stats in nv_remove",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74548",
    "datePublished": "2026-08-15T12:27:56.387Z",
    "dateReserved": "2026-08-15T05:44:03.915Z",
    "dateUpdated": "2026-08-19T16:38:39.684Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74548",
      "date": "2026-09-21",
      "epss": "0.00126",
      "percentile": "0.02601"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-11T01:52:43.000Z",
      "cve": "CVE-2026-74548",
      "id": "msrc_CVE-2026-74548",
      "initial_release_date": "2026-08-23T14:45:23.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "forcedeth: fix UAF of txrx_stats in nv_remove",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-74548.json",
      "version": "2"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/ethernet/nvidia/forcedeth.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "cdf864d5d3c813ae1876f2bacc1cf3ac3c66dfc9",
                    "status": "affected",
                    "version": "f4b633b911fd3b4cbe1dc065e8fb064078d0889d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "7c22b4ee0bd003cecfc14ca28981cb213e201f70",
                    "status": "affected",
                    "version": "f4b633b911fd3b4cbe1dc065e8fb064078d0889d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d51ce7a63b76eda02cabfed1b0cc277b2f5c9bcc",
                    "status": "affected",
                    "version": "f4b633b911fd3b4cbe1dc065e8fb064078d0889d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "cf2dcde2284562ff87830ca0b7fa2b06e95aef1e",
                    "status": "affected",
                    "version": "f4b633b911fd3b4cbe1dc065e8fb064078d0889d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c9d24a205fd508b9999fcab6aca4c590490a12cf",
                    "status": "affected",
                    "version": "f4b633b911fd3b4cbe1dc065e8fb064078d0889d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ae20a8a4de06a289d40b0a0633d8d573f1fcb049",
                    "status": "affected",
                    "version": "f4b633b911fd3b4cbe1dc065e8fb064078d0889d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "201e05aa531eba0dfe2ee05b4e178f6ffa12c8b1",
                    "status": "affected",
                    "version": "f4b633b911fd3b4cbe1dc065e8fb064078d0889d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "22666ba1420164753d7b0f5a841986b25ace5435",
                    "status": "affected",
                    "version": "f4b633b911fd3b4cbe1dc065e8fb064078d0889d",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/ethernet/nvidia/forcedeth.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.3"
                  },
                  {
                    "lessThan": "5.3",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.265",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.216",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.183",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.151",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.103",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.44",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.8",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nforcedeth: fix UAF of txrx_stats in nv_remove\n\nnv_remove() frees the per-CPU txrx_stats before unregister_netdev().\nUntil unregister completes, ndo_get_stats64, the NAPI/xmit data path,\nand nv_close()/drain may still access txrx_stats, leading to a\nuse-after-free.\n\nFree the stats only after unregister_netdev()."
          }
        ],
        "id": "CVE-2026-74548",
        "lastModified": "2026-08-19T17:21:09.690",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-15T13:18:00.170",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/201e05aa531eba0dfe2ee05b4e178f6ffa12c8b1"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/22666ba1420164753d7b0f5a841986b25ace5435"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/7c22b4ee0bd003cecfc14ca28981cb213e201f70"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/ae20a8a4de06a289d40b0a0633d8d573f1fcb049"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/c9d24a205fd508b9999fcab6aca4c590490a12cf"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/cdf864d5d3c813ae1876f2bacc1cf3ac3c66dfc9"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/cf2dcde2284562ff87830ca0b7fa2b06e95aef1e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d51ce7a63b76eda02cabfed1b0cc277b2f5c9bcc"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-21T11:33:26+00:00",
      "cve": "CVE-2026-74548",
      "id": "CVE-2026-74548",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: forcedeth: fix UAF of txrx_stats in nv_remove",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74548.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-18T00:26:31Z",
      "cve": "CVE-2026-74548",
      "id": "CVE-2026-74548",
      "initial_release_date": "2026-08-15T23:50:32Z",
      "product_status:first_fixed": "23",
      "product_status:known_affected": "713",
      "product_status:known_not_affected": "6",
      "product_status:recommended": "107",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-74548",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-74548.json",
      "version": "12"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.