CVE-2026-74545: rtase: fix double free of multi-frag skb on DMA map failure
In the Linux kernel, the following vulnerability has been resolved:
rtase: fix double free of multi-frag skb on DMA map failure
In rtasestartxmit(), when the head buffer DMA mapping fails after rtasexmitfrags() has mapped all fragments, the error path clears the fragment descriptors with rtasetxclearrange(), which frees the skb through the last-frag slot and accounts txdropped. Control then falls through to the common error label, which frees the same skb a second time and counts it again.
Return right after clearing the fragments when the skb owns frags; the no-frag case still drops through and frees the head skb once.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74545?
CVE-2026-74545 has a risk rating of 34.
How do I fix CVE-2026-74545?
To fix CVE-2026-74545, apply the latest updates to the Linux kernel that address this vulnerability.
What does CVE-2026-74545 affect?
CVE-2026-74545 affects the Linux kernel, specifically related to the rtase module.
What is the nature of the vulnerability in CVE-2026-74545?
CVE-2026-74545 involves a double free error that occurs on DMA map failure in multi-frag skb handling.
When was CVE-2026-74545 published?
CVE-2026-74545 was published on August 15, 2026.