CVE-2026-74545

In the Linux kernel, the following vulnerability has been resolved:

rtase: fix double free of multi-frag skb on DMA map failure

In rtasestartxmit(), when the head buffer DMA mapping fails after

rtasexmitfrags() has mapped all fragments, the error path clears

the fragment descriptors with rtasetxclear_range(), which frees

the skb through the last-frag slot and accounts tx_dropped. Control

then falls through to the common error label, which frees the same

skb a second time and counts it again.

Return right after clearing the fragments when the skb owns frags;

the no-frag case still drops through and frees the head skb once.