CVE-2026-74725
Received Received - Intake

enic: Use-After-Free in TX Hang Reset on Device Removal

Publication date: 2026-08-22

Last updated on: 2026-08-22

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: enic: fix tx_hang_reset use-after-free on device removal enic_remove() cancels the reset and change_mtu_work items but does not cancel tx_hang_reset. A TX timeout that fires while the device is being removed can schedule enic_tx_hang_reset() so that it runs after free_netdev(), resulting in a use-after-free. cancel_work_sync() alone is not sufficient here: the still-live watchdog and notify paths can re-schedule these work items in the window between the cancel and unregister_netdev(). Use disable_work_sync(), which cancels the work and blocks any subsequent schedule_work() from requeuing it, and apply it to the reset and change_mtu_work items as well so the same requeue race is closed for all teardown work.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-22
Last Modified
2026-08-22
Generated
2026-08-22
AI Q&A
2026-08-22
EPSS Evaluated
N/A
NVD
CVE-2026-74725
EUVD
EUVD-2026-64412

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a use-after-free issue in the enic driver. When a device is removed, the cleanup process fails to properly cancel the tx_hang_reset work item. If a TX timeout occurs during removal, it can schedule tx_hang_reset after the device memory has been freed, leading to a use-after-free condition.

Detection Guidance

This vulnerability is specific to the Linux kernel's enic driver and involves a use-after-free condition during device removal. Detection requires checking kernel logs for crashes or warnings related to enic driver or TX timeouts. Monitor system logs for messages like 'enic_tx_hang_reset' or 'use-after-free' errors during network device removal or driver unloading.

Impact Analysis

This vulnerability could allow an attacker to cause a system crash or execute arbitrary code with kernel privileges by triggering a TX timeout during device removal. It primarily affects systems using the enic driver for network devices.

Mitigation Strategies

Apply the latest kernel update that includes the fix for this issue. Avoid removing network devices while they are actively in use. If you cannot update immediately, consider disabling the enic driver or the affected network interface until a patch is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74725. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart