---
id: CVE-2026-74548
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  forcedeth: fix UAF of txrx_stats in nv_remove

  nv_remove() frees the per-CPU txrx_stats before unregister_netdev().
  Until unregister completes, ndo_get_stats64, the NAP…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  forcedeth: fix UAF of txrx_stats in nv_remove

  nv_remove() frees the per-CPU txrx_stats before unregister_netdev().
  Until unregister completes, ndo_get_stats64, the NAP…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= f4b633b911fd3b4cbe1dc065e8fb064078d0889d <
    cdf864d5d3c813ae1876f2bacc1cf3ac3c66dfc9
  - >-
    Linux >= f4b633b911fd3b4cbe1dc065e8fb064078d0889d <
    7c22b4ee0bd003cecfc14ca28981cb213e201f70
  - >-
    Linux >= f4b633b911fd3b4cbe1dc065e8fb064078d0889d <
    d51ce7a63b76eda02cabfed1b0cc277b2f5c9bcc
  - >-
    Linux >= f4b633b911fd3b4cbe1dc065e8fb064078d0889d <
    cf2dcde2284562ff87830ca0b7fa2b06e95aef1e
  - >-
    Linux >= f4b633b911fd3b4cbe1dc065e8fb064078d0889d <
    c9d24a205fd508b9999fcab6aca4c590490a12cf
  - >-
    Linux >= f4b633b911fd3b4cbe1dc065e8fb064078d0889d <
    ae20a8a4de06a289d40b0a0633d8d573f1fcb049
  - >-
    Linux >= f4b633b911fd3b4cbe1dc065e8fb064078d0889d <
    201e05aa531eba0dfe2ee05b4e178f6ffa12c8b1
  - >-
    Linux >= f4b633b911fd3b4cbe1dc065e8fb064078d0889d <
    22666ba1420164753d7b0f5a841986b25ace5435
  - Linux 5.3
published: '2026-08-15'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T20:17:36.873'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-74548'
references:
  - url: 'https://git.kernel.org/stable/c/201e05aa531eba0dfe2ee05b4e178f6ffa12c8b1'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/22666ba1420164753d7b0f5a841986b25ace5435'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/7c22b4ee0bd003cecfc14ca28981cb213e201f70'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/ae20a8a4de06a289d40b0a0633d8d573f1fcb049'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/c9d24a205fd508b9999fcab6aca4c590490a12cf'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/cdf864d5d3c813ae1876f2bacc1cf3ac3c66dfc9'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/cf2dcde2284562ff87830ca0b7fa2b06e95aef1e'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/d51ce7a63b76eda02cabfed1b0cc277b2f5c9bcc'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
epss: 0.00126
epssPercentile: 0.02237
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T18:59:51.900384Z'
ingestedAt: '2026-10-16T19:46:24.346Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

forcedeth: fix UAF of txrx_stats in nv_remove

nv_remove() frees the per-CPU txrx_stats before unregister_netdev().
Until unregister completes, ndo_get_stats64, the NAPI/xmit data path,
and nv_close()/drain may still access txrx_stats, leading to a
use-after-free.

Free the stats only after unregister_netdev().

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.