The forcedeth driver’s nv_remove() function frees per-CPU txrx_stats before unregister_netdev() completes. While these structures can still be accessed by ndo_get_stats64, the NAPI/xmit path, or nv_close/drain, the freed memory can be dereferenced, resulting in a use-After-Free. This lets a local attacker, or any process that can trigger device removal, corrupt kernel memory, potentially leading to arbitrary code execution or a denial-of-service failure in the kernel.

All Linux kernel installations that include the forcedeth driver and have not incorporated the commit that delays freeing txrx_stats until after unregister_netdev(). No specific version ranges are published, so any kernel lacking the patch is considered potentially affected.

The EPSS score is < 1% and the vulnerability is not listed in KEV. The vulnerability is a classic use-After-Free. With a CVSS score of 7.8, the vulnerability implies a high local privilege escalation risk once exploited. The attack vector is inferred to be local: an individual with sufficient privileges can remove the device to trigger the flaw. Remote exploitation would require a pathway to locally trigger the vulnerable code path; it is not explicitly documented but could be possible if such a path exists.