CVE-2026-74548

A flaw was found in the forcedeth component of the Linux kernel. The nv_remove() function frees the per-CPU txrx_stats before unregister_netdev() completes. This timing issue allows other functions, such as ndo_get_stats64, the NAPI/xmit data path, and nv_close()/drain, to access the freed memory, leading to a use-after-free vulnerability. This could potentially lead to system instability or denial of service.

A use-after-free flaw of Moderate impact was found in the Linux kernel's forcedeth network driver. The nv_remove() function frees the per-CPU txrx_stats memory before unregister_netdev() has completed, so code paths that can still execute until unregistration finishes, such as ndo_get_stats64, the NAPI/xmit data path, and nv_close()/drain, may access the freed memory. Exploiting this flaw requires local access with the privileges needed to remove the underlying NVIDIA network device, and the primary consequence is system instability or a kernel panic resulting in denial of service; no impact on confidentiality or integrity has been established. Red Hat Enterprise Linux and Red Hat In-Vehicle OS are not affected by this flaw because the vulnerable code is not present in the shipped kernel packages. The upstream CVE.org severity of Important (CVSS 7.8) is higher than the Red Hat rating of Moderate (CVSS 5.5) because it assumes full confidentiality and integrity impact, which is not established for this use-after-free of statistics memory.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.