A high-severity use-after-free vulnerability in the Linux kernel forcedeth driver may allow a local authenticated attacker to compromise system integrity and availability.

The forcedeth driver improperly handles the removal process by freeing per-CPU statistics before unregistering the network device, leading to a use-after-free condition. This vulnerability requires local access with low-level privileges to trigger the race condition.

Successful exploitation of this flaw can result in a kernel panic, leading to system downtime, or potential arbitrary code execution with elevated privileges. Given the CVSS score of 7.8, this vulnerability poses a significant risk to the stability and security of affected server environments.

Immediate Action: Update the Linux kernel to version 6.6.151, 6.12.103, 6.18.44, 7.1.8, or later, as provided by your distribution vendor.

Proactive Monitoring: Monitor system logs for kernel oops or unexpected service restarts associated with the forcedeth driver.

Compensating Controls: Restrict access to the system to only authorized users, as this vulnerability requires local access to exploit.

Public Exploit Available: No

The vulnerability presents a high risk to system stability and security. Administrators should prioritize patching the kernel across all impacted Linux environments to mitigate the risk of local privilege escalation or denial-of-service attacks.