---
id: CVE-2026-74548
title: 'forcedeth: fix UAF of txrx_stats in nv_remove'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  forcedeth: fix UAF of txrx_stats in nv_remove

  nv_remove() frees the per-CPU txrx_stats before unregister_netdev().
  Until unregister completes, ndo_get_stats64, the NAP…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= f4b633b911fd3b4cbe1dc065e8fb064078d0889d <
    cdf864d5d3c813ae1876f2bacc1cf3ac3c66dfc9
  - >-
    Linux >= f4b633b911fd3b4cbe1dc065e8fb064078d0889d <
    7c22b4ee0bd003cecfc14ca28981cb213e201f70
  - >-
    Linux >= f4b633b911fd3b4cbe1dc065e8fb064078d0889d <
    d51ce7a63b76eda02cabfed1b0cc277b2f5c9bcc
  - >-
    Linux >= f4b633b911fd3b4cbe1dc065e8fb064078d0889d <
    cf2dcde2284562ff87830ca0b7fa2b06e95aef1e
  - >-
    Linux >= f4b633b911fd3b4cbe1dc065e8fb064078d0889d <
    c9d24a205fd508b9999fcab6aca4c590490a12cf
  - >-
    Linux >= f4b633b911fd3b4cbe1dc065e8fb064078d0889d <
    ae20a8a4de06a289d40b0a0633d8d573f1fcb049
  - >-
    Linux >= f4b633b911fd3b4cbe1dc065e8fb064078d0889d <
    201e05aa531eba0dfe2ee05b4e178f6ffa12c8b1
  - >-
    Linux >= f4b633b911fd3b4cbe1dc065e8fb064078d0889d <
    22666ba1420164753d7b0f5a841986b25ace5435
  - Linux 5.3
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T18:59:51.900384Z'
published: '2026-08-15'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T19:05:55.094Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-74548'
references:
  - url: 'https://git.kernel.org/stable/c/cdf864d5d3c813ae1876f2bacc1cf3ac3c66dfc9'
  - url: 'https://git.kernel.org/stable/c/7c22b4ee0bd003cecfc14ca28981cb213e201f70'
  - url: 'https://git.kernel.org/stable/c/d51ce7a63b76eda02cabfed1b0cc277b2f5c9bcc'
  - url: 'https://git.kernel.org/stable/c/cf2dcde2284562ff87830ca0b7fa2b06e95aef1e'
  - url: 'https://git.kernel.org/stable/c/c9d24a205fd508b9999fcab6aca4c590490a12cf'
  - url: 'https://git.kernel.org/stable/c/ae20a8a4de06a289d40b0a0633d8d573f1fcb049'
  - url: 'https://git.kernel.org/stable/c/201e05aa531eba0dfe2ee05b4e178f6ffa12c8b1'
  - url: 'https://git.kernel.org/stable/c/22666ba1420164753d7b0f5a841986b25ace5435'
tags:
  - cve.org
epss: 0.00126
epssPercentile: 0.02031
ingestedAt: '2026-10-16T19:46:24.346Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

forcedeth: fix UAF of txrx_stats in nv_remove

nv_remove() frees the per-CPU txrx_stats before unregister_netdev().
Until unregister completes, ndo_get_stats64, the NAPI/xmit data path,
and nv_close()/drain may still access txrx_stats, leading to a
use-after-free.

Free the stats only after unregister_netdev().

## Affected

- `Linux >= f4b633b911fd3b4cbe1dc065e8fb064078d0889d < cdf864d5d3c813ae1876f2bacc1cf3ac3c66dfc9`
- `Linux >= f4b633b911fd3b4cbe1dc065e8fb064078d0889d < 7c22b4ee0bd003cecfc14ca28981cb213e201f70`
- `Linux >= f4b633b911fd3b4cbe1dc065e8fb064078d0889d < d51ce7a63b76eda02cabfed1b0cc277b2f5c9bcc`
- `Linux >= f4b633b911fd3b4cbe1dc065e8fb064078d0889d < cf2dcde2284562ff87830ca0b7fa2b06e95aef1e`
- `Linux >= f4b633b911fd3b4cbe1dc065e8fb064078d0889d < c9d24a205fd508b9999fcab6aca4c590490a12cf`
- `Linux >= f4b633b911fd3b4cbe1dc065e8fb064078d0889d < ae20a8a4de06a289d40b0a0633d8d573f1fcb049`
- `Linux >= f4b633b911fd3b4cbe1dc065e8fb064078d0889d < 201e05aa531eba0dfe2ee05b4e178f6ffa12c8b1`
- `Linux >= f4b633b911fd3b4cbe1dc065e8fb064078d0889d < 22666ba1420164753d7b0f5a841986b25ace5435`
- `Linux 5.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.