Skip to main content

Linux Kernel CVE-2026-74548

| EUVDEUVD-2026-59741 HIGH
2026-08-15 Linux GHSA-xvfj-3828-276m
Information Disclosure Linux Red Hat Suse
7.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

Race condition during device teardown requires precise timing, warranting AC:H; PR:L reflects local user access needed to trigger or race the removal path.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
6.4 HIGH
AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 17, 2026 - 12:20 vuln.today
CVSS changed
Aug 17, 2026 - 06:22 NVD
7.8 (HIGH)
Patch available
Aug 15, 2026 - 13:04 EUVD
CVE Published
Aug 15, 2026 - 12:27 cve.org
UNKNOWN (no severity yet)
CVE Published
Aug 15, 2026 - 12:27 cve.org
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

forcedeth: fix UAF of txrx_stats in nv_remove

nv_remove() frees the per-CPU txrx_stats before unregister_netdev(). Until unregister completes, ndo_get_stats64, the NAPI/xmit data path, and nv_close()/drain may still access txrx_stats, leading to a use-after-free.

Free the stats only after unregister_netdev().

AnalysisAI

Use-after-free in the Linux kernel's forcedeth Ethernet driver allows a local user to trigger kernel memory corruption during device removal. The driver's nv_remove() function frees per-CPU txrx_stats before unregister_netdev() completes, leaving the ndo_get_stats64 statistics path, NAPI polling, xmit data path, and nv_close()/drain all capable of accessing the already-freed structure. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon
Gain local user access on target
Delivery
Confirm forcedeth driver loaded on NVIDIA hardware
Exploit
Initiate device removal while network I/O is active
Install
Race nv_remove() freeing txrx_stats against concurrent kernel path
C2
Dereference freed txrx_stats via ndo_get_stats64 or NAPI
Execute
Corrupt kernel memory via use-after-free
Impact
Escalate privileges or destabilize system
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires local system access with at least standard user privileges (CVSS PR:L, AV:L). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a locally exploitable kernel UAF with full confidentiality, integrity, and availability impact - consistent with the well-established exploitation class of kernel memory corruption primitives that can be chained into local privilege escalation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario A local user on a system with NVIDIA nForce-era Ethernet hardware initiates or waits for a device removal event - such as a hotplug removal, module unload, or system shutdown - while network traffic is actively being processed by the forcedeth driver. The race between nv_remove() freeing txrx_stats and an in-flight ndo_get_stats64() call or NAPI softirq accessing the freed structure creates a use-after-free condition in kernel memory. …
Remediation The primary fix is to upgrade the Linux kernel to a patched stable release: 6.6.151, 6.12.103, 6.18.44, 7.1.8, or 7.2-rc6, depending on the distribution's supported branch. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, identify all systems running forcedeth Ethernet drivers (prevalent on legacy NVIDIA nForce systems) and confirm patch availability from your Linux vendor. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-74548 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy