CVE-2026-74545
rtase: fix double free of multi-frag skb on DMA map failure
Description
In the Linux kernel, the following vulnerability has been resolved: rtase: fix double free of multi-frag skb on DMA map failure In rtase_start_xmit(), when the head buffer DMA mapping fails after rtase_xmit_frags() has mapped all fragments, the error path clears the fragment descriptors with rtase_tx_clear_range(), which frees the skb through the last-frag slot and accounts tx_dropped. Control then falls through to the common error label, which frees the same skb a second time and counts it again. Return right after clearing the fragments when the skb owns frags; the no-frag case still drops through and frees the head skb once.
INFO
Published Date :
Aug. 15, 2026, 1:17 p.m.
Last Modified :
Aug. 15, 2026, 1:17 p.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Affected Products
The following products are affected by CVE-2026-74545
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
No affected product recoded yet
Solution
- Apply the patch for rtase: fix double free of multi-frag skb.
- Update the Linux kernel to the latest version.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-74545.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-74545 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-74545
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-74545 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-74545 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Aug. 15, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'd6e882b89fdf80be0ab4f914ec10f75215e49495', 'lessThan': '4f09172aff5f73a5e914f4fbc0d00a1c2ea9f7cb', 'versionType': 'git'}, {'status': 'affected', 'version': 'd6e882b89fdf80be0ab4f914ec10f75215e49495', 'lessThan': 'db986098f30881fafcc752800aa3b13fd289c922', 'versionType': 'git'}, {'status': 'affected', 'version': 'd6e882b89fdf80be0ab4f914ec10f75215e49495', 'lessThan': 'de691dc3227b061c4d0beba9f0128fe1ff33dd68', 'versionType': 'git'}, {'status': 'affected', 'version': 'd6e882b89fdf80be0ab4f914ec10f75215e49495', 'lessThan': '6fb7b769d6ed6d1d2e02af4a80e57a2477f35086', 'versionType': 'git'}], 'programFiles': ['drivers/net/ethernet/realtek/rtase/rtase_main.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '6.12'}, {'status': 'unaffected', 'version': '0', 'lessThan': '6.12', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.12.103', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.44', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.8', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc6', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/net/ethernet/realtek/rtase/rtase_main.c'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: rtase: fix double free of multi-frag skb on DMA map failure In rtase_start_xmit(), when the head buffer DMA mapping fails after rtase_xmit_frags() has mapped all fragments, the error path clears the fragment descriptors with rtase_tx_clear_range(), which frees the skb through the last-frag slot and accounts tx_dropped. Control then falls through to the common error label, which frees the same skb a second time and counts it again. Return right after clearing the fragments when the skb owns frags; the no-frag case still drops through and frees the head skb once. Added Reference https://git.kernel.org/stable/c/4f09172aff5f73a5e914f4fbc0d00a1c2ea9f7cb Added Reference https://git.kernel.org/stable/c/6fb7b769d6ed6d1d2e02af4a80e57a2477f35086 Added Reference https://git.kernel.org/stable/c/db986098f30881fafcc752800aa3b13fd289c922 Added Reference https://git.kernel.org/stable/c/de691dc3227b061c4d0beba9f0128fe1ff33dd68