CVE-2026-74725enic: fix tx_hang_reset use-after-free on device removal
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: enic: fix tx_hang_reset use-after-free on device removal enic_remove() cancels the reset and change_mtu_work items but does not cancel tx_hang_reset. A TX timeout that fires while the device is being removed can schedule enic_tx_hang_reset() so that it runs after free_netdev(), resulting in a use-after-free. cancel_work_sync() alone is not sufficient here: the still-live watchdog and notify paths can re-schedule these work items in the window between the cancel and unregister_netdev(). Use disable_work_sync(), which cancels the work and blocks any subsequent schedule_work() from requeuing it, and apply it to the reset and change_mtu_work items as well so the same requeue race is closed for all teardown work.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 937317c7c1097aa878a5000e3aab616eb5c590c0 before 8619865f34fb3b130b567855382a5c4aadd522b9; from 937317c7c1097aa878a5000e3aab616eb5c590c0 before e506e704b74748ffd0e1c92a7453ca2a959f832b; 937317c7c1097aa878a5000e3aab616eb5c590c0 builds before 4f3464fc6c1f26afc504fd525c574f2bc14c9d42; from 937317c7c1097aa878a5000e3aab616eb5c590c0 before ec680ea4ba1bca92a767fb7e7869758bfdd886e3 | CNA record |
References
- https://git.kernel.org/stable/c/8619865f34fb3b130b567855382a5c4aadd522b9
- https://git.kernel.org/stable/c/e506e704b74748ffd0e1c92a7453ca2a959f832b
- https://git.kernel.org/stable/c/4f3464fc6c1f26afc504fd525c574f2bc14c9d42
- https://git.kernel.org/stable/c/ec680ea4ba1bca92a767fb7e7869758bfdd886e3
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.