Linux Kernel EUVD-2026-59738

Exploitation requires the target host to load the rtase driver - i.e., it must have a Realtek RTL90xx-class automotive/multi-gigabit Ethernet controller and be transmitting a multi-fragment (fragmented/scatter-gather) skb. The critical trigger is a DMA mapping failure on the head buffer AFTER the fragments have already been mapped, which is an internal error path (e.g., IOMMU exhaustion, low memory, or DMA-address constraints) not directly attacker-supplied over the network. Limiting factors: the bug does not fire on the non-fragmented path (single-skb case frees correctly), the affected driver is rarely deployed, and the DMA-failure precondition is hard to force deterministically. Despite the input CVSS AV:N/PR:N, this is realistically a locally/error-triggered condition, not remote-unauthenticated exploitation of a default configuration.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, 9.8 Critical) sharply contradicts the actual defect. The bug triggers only inside a TX error path when a DMA map operation fails - an internal, resource-exhaustion/error condition an ordinary network attacker cannot reliably drive, so AV:N/AC:L/PR:N is almost certainly automated over-scoring typical of bulk Linux kernel CVEs rather than a true remote-unauthenticated RCE. Corroborating signals point to low real-world risk: EPSS is 0.17% (7th percentile), the CVE is NOT on CISA KEV, and no POC is referenced. Practical impact is kernel crash/denial of service and potential slab corruption, requiring local presence and a triggerable DMA failure. The dominant limiting factor is prevalence: rtase is a niche Realtek automotive/multi-gig driver present on very few systems. Conflicting data explicitly noted: CVSS claims network vector and high confidentiality/integrity impact, but the description implies a locally-triggered, availability-oriented double-free - verify severity against the kernel maintainers' own assessment before treating as a network-exploitable critical.

A local attacker (or a fault-injection/high-memory-pressure condition) causes head-buffer DMA mapping to fail during transmission of a multi-fragment packet on an rtase interface, driving the error path to free the same skb twice and corrupting the kernel slab allocator, which crashes the host or, with careful heap grooming, could be leveraged toward privilege escalation. No public exploit code is referenced, and reliably forcing the DMA-map failure is non-trivial, making practical exploitation difficult.