Use-After-Free Issue in the Linux Kernel Network Driver

CVE-2026-74548

What is CVE-2026-74548?

A use-after-free vulnerability exists within the Linux kernel's forcedeth network driver due to improper handling of the per-CPU txrx_stats structure during device unregistration. Specifically, the nv_remove() function incorrectly frees txrx_stats before the unregister_netdev() function is executed. This sequence allows the access to freed memory, potentially leading to unstable behavior or exploit opportunities. The issue has been mitigated by ensuring the stat structure is only freed after the unregistration process has been fully completed, thus safeguarding memory management during network operations.

References