What is the CVSS score of CVE-2026-74545?

CVE-2026-74545 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-74545?

A critical memory corruption vulnerability (CVSS 9.8) in Realtek's rtase automotive Ethernet driver for Linux kernel 6.12 can cause kernel-level crashes and service unavailability on affected…. A patch is available.

How to fix or mitigate CVE-2026-74545?

Within 24 hours, identify and inventory all systems running Linux kernel 6.12 with the Realtek rtase driver installed, prioritizing production automotive Ethernet and networking infrastructure. Within 7 days, begin staged patching of identified systems with the vendor-released patch for kernel 6.12, starting with critical infrastructure and test environments. Complete full remediation across all affected systems within 30 days; if immediate kernel patching is not feasible, consider isolating affected systems from external network access or disabling the rtase driver if alternative connectivity exists.

Linux Kernel CVE-2026-74545

EUVD-2026-59738 CRITICAL

2026-08-15 Linux

GHSA-v487-w46v-372v

Information Disclosure Linux Suse

9.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

4.7 MEDIUM

Double free fires only in a hard-to-force local TX DMA-failure path on a niche driver, so AV:L/AC:H/PR:L; impact is kernel crash/DoS, hence A:H with no direct C/I.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

7.0 HIGH

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 12:19 vuln.today

CVSS changed

Aug 17, 2026 - 06:22 NVD

9.8 (CRITICAL)

Patch available

Aug 15, 2026 - 13:04 EUVD

CVE Published

Aug 15, 2026 - 12:27 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 15, 2026 - 12:27 cve.org

CRITICAL 9.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

rtase: fix double free of multi-frag skb on DMA map failure

In rtase_start_xmit(), when the head buffer DMA mapping fails after rtase_xmit_frags() has mapped all fragments, the error path clears the fragment descriptors with rtase_tx_clear_range(), which frees the skb through the last-frag slot and accounts tx_dropped. Control then falls through to the common error label, which frees the same skb a second time and counts it again.

Return right after clearing the fragments when the skb owns frags; the no-frag case still drops through and frees the head skb once.

AnalysisAI

A double-free memory-corruption defect in the Linux kernel's rtase Realtek automotive Ethernet driver allows the same multi-fragment socket buffer to be freed twice when the transmit path hits a DMA mapping failure. It affects hosts running the rtase driver (Realtek multi-gigabit/automotive NICs) on kernel 6.12 and related stable trees, and can lead to kernel memory corruption and denial of service. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Load rtase driver on Realtek NIC

Delivery

Induce DMA/memory pressure during TX

Exploit

Send multi-fragment packet

Execution

Head-buffer DMA map fails

Persist

Same skb freed twice

Impact

Slab corruption and kernel crash

Access

Load rtase driver on Realtek NIC

Delivery

Induce DMA/memory pressure during TX

Exploit

Send multi-fragment packet

Execution

Head-buffer DMA map fails

Persist

Same skb freed twice

Impact

Slab corruption and kernel crash

Vulnerability AssessmentAI

Exploitation	Exploitation requires the target host to load the rtase driver - i.e., it must have a Realtek RTL90xx-class automotive/multi-gigabit Ethernet controller and be transmitting a multi-fragment (fragmented/scatter-gather) skb. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, 9.8 Critical) sharply contradicts the actual defect. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	A local attacker (or a fault-injection/high-memory-pressure condition) causes head-buffer DMA mapping to fail during transmission of a multi-fragment packet on an rtase interface, driving the error path to free the same skb twice and corrupting the kernel slab allocator, which crashes the host or, with careful heap grooming, could be leveraged toward privilege escalation. No public exploit code is referenced, and reliably forcing the DMA-map failure is non-trivial, making practical exploitation difficult.
Remediation	Vendor-released patch: update to a fixed stable kernel - 6.12.103, 7.1.8, or 6.18.44 (fix also in 7.2-rc6), corresponding to kernel.org stable commits 6fb7b769d6ed, 4f09172aff5f, de691dc3227b, and db986098f308; the fix returns immediately after clearing fragments when the skb owns frags so the head skb is freed exactly once. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, identify and inventory all systems running Linux kernel 6.12 with the Realtek rtase driver installed, prioritizing production automotive Ethernet and networking infrastructure. …

Threat intelligence, references, and detailed analysis are available after sign-in.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

CVE-2026-74545 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-74545

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Unlock full vulnerability intelligence

Attack ChainAIDerived

Vulnerability AssessmentAI

Recommended ActionAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code