Description

In the Linux kernel, the following vulnerability has been resolved: forcedeth: fix UAF of txrx_stats in nv_remove nv_remove() frees the per-CPU txrx_stats before unregister_netdev(). Until unregister completes, ndo_get_stats64, the NAPI/xmit data path, and nv_close()/drain may still access txrx_stats, leading to a use-after-free. Free the stats only after unregister_netdev().

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-15T13:18:00.170Z",
  "pubdate": "2026-08-15T13:18:00.170Z",
  "executiveSummary": "A use-after-free vulnerability exists in the Linux kernel forcedeth network driver, specifically within the driver removal routine nv_remove().\nThe vulnerability is classified as a use-after-free (UAF) issue, which arises due to improper memory deallocation ordering during the unregistration and teardown of the network device.\nThe primary impact of this flaw is potential kernel memory corruption, system instability, or arbitrary code execution, posing a significant risk to system integrity and availability.\nThe affected product is the Linux kernel utilizing the forcedeth network interface card driver.\nExploitation of this vulnerability requires local access to the system and the ability to trigger the driver removal or device unbinding process while concurrent operations are interacting with the network statistics subsystem.\nThe risk implications involve local privilege escalation or denial of service through kernel panics caused by accessing deallocated memory structures.",
  "technicalDetails": "The vulnerability resides in the nv_remove() function of the forcedeth driver within the Linux kernel source tree.\nThe root cause of the vulnerability is a race condition driven by incorrect ordering of resource deallocation during device teardown. Specifically, nv_remove() prematurely frees the per-CPU txrx_stats memory structure before calling unregister_netdev().\nUntil unregister_netdev() completes execution, several asynchronous execution paths and callback mechanisms—including ndo_get_stats64, the NAPI polling routine, the packet transmission (xmit) data path, and nv_close()/drain operations—may still actively reference or attempt to update the per-CPU txrx_stats structures.\nBecause the memory backing txrx_stats has already been released to the kernel memory allocator, these concurrent accesses result in a classic use-after-free condition.\nAn attacker or system process can exploit this flow by triggering the removal of the network interface (e.g., via module unloading or device hot-unplug) while network traffic is actively being processed or statistics are being queried.\nThe attack flow proceeds as follows: 1) The driver cleanup routine nv_remove() is invoked. 2) The driver frees the per-CPU txrx_stats memory block. 3) Concurrently, kernel subsystems or network interfaces invoke ndo_get_stats64 or data path handlers that dereference the freed memory address. 4) The kernel attempts to read or write to the dangling pointer, causing memory corruption or a kernel crash.\nThe vulnerable component is the memory management logic inside the forcedeth driver's removal sequence.\nNo specific authentication or network exposure is required beyond local execution capabilities to trigger driver unbinding or module removal."
}