GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-74725 (GCVE-0-2026-74725)

Vulnerability from cvelistv5 – Published: 2026-08-22 15:33 – Updated: 2026-08-25 05:42
VLAI
Title
enic: fix tx_hang_reset use-after-free on device removal
Summary
In the Linux kernel, the following vulnerability has been resolved: enic: fix tx_hang_reset use-after-free on device removal enic_remove() cancels the reset and change_mtu_work items but does not cancel tx_hang_reset. A TX timeout that fires while the device is being removed can schedule enic_tx_hang_reset() so that it runs after free_netdev(), resulting in a use-after-free. cancel_work_sync() alone is not sufficient here: the still-live watchdog and notify paths can re-schedule these work items in the window between the cancel and unregister_netdev(). Use disable_work_sync(), which cancels the work and blocks any subsequent schedule_work() from requeuing it, and apply it to the reset and change_mtu_work items as well so the same requeue race is closed for all teardown work.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 937317c7c1097aa878a5000e3aab616eb5c590c0 , < 8619865f34fb3b130b567855382a5c4aadd522b9 (git)
Affected: 937317c7c1097aa878a5000e3aab616eb5c590c0 , < e506e704b74748ffd0e1c92a7453ca2a959f832b (git)
Affected: 937317c7c1097aa878a5000e3aab616eb5c590c0 , < 4f3464fc6c1f26afc504fd525c574f2bc14c9d42 (git)
Affected: 937317c7c1097aa878a5000e3aab616eb5c590c0 , < ec680ea4ba1bca92a767fb7e7869758bfdd886e3 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.4
Unaffected: 0 , < 4.4 (semver)
Unaffected: 6.12.104 , ≤ 6.12.* (semver)
Unaffected: 6.18.45 , ≤ 6.18.* (semver)
Unaffected: 7.1.9 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/cisco/enic/enic_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8619865f34fb3b130b567855382a5c4aadd522b9",
              "status": "affected",
              "version": "937317c7c1097aa878a5000e3aab616eb5c590c0",
              "versionType": "git"
            },
            {
              "lessThan": "e506e704b74748ffd0e1c92a7453ca2a959f832b",
              "status": "affected",
              "version": "937317c7c1097aa878a5000e3aab616eb5c590c0",
              "versionType": "git"
            },
            {
              "lessThan": "4f3464fc6c1f26afc504fd525c574f2bc14c9d42",
              "status": "affected",
              "version": "937317c7c1097aa878a5000e3aab616eb5c590c0",
              "versionType": "git"
            },
            {
              "lessThan": "ec680ea4ba1bca92a767fb7e7869758bfdd886e3",
              "status": "affected",
              "version": "937317c7c1097aa878a5000e3aab616eb5c590c0",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/cisco/enic/enic_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.4"
            },
            {
              "lessThan": "4.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nenic: fix tx_hang_reset use-after-free on device removal\n\nenic_remove() cancels the reset and change_mtu_work items but does not\ncancel tx_hang_reset. A TX timeout that fires while the device is being\nremoved can schedule enic_tx_hang_reset() so that it runs after\nfree_netdev(), resulting in a use-after-free.\n\ncancel_work_sync() alone is not sufficient here: the still-live watchdog\nand notify paths can re-schedule these work items in the window between\nthe cancel and unregister_netdev(). Use disable_work_sync(), which\ncancels the work and blocks any subsequent schedule_work() from\nrequeuing it, and apply it to the reset and change_mtu_work items as\nwell so the same requeue race is closed for all teardown work."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The UAF occurs during enic_remove() PCI/driver teardown (sysfs unbind, rmmod, or hot-unplug); TX timeout is raised by the local netdev watchdog, not by remote packet processing, and there is no standalone network path into enic_remove itself.\nAC:L - This is a workqueue race during removal: once teardown starts the netdev can still be up so the watchdog schedules enic_tx_hang_reset, and an attacker can reliably drive TX timeout by stalling or flooding xmit on the still-registered interface while removal proceeds.\nPR:L - PCI unbind/module unload needs elevated privileges, but an unprivileged local or tenant workload can supply the concurrent netdev watchdog TX timeout (local/remote traffic on the Cisco VIC uplink) that schedules tx_hang_reset; per driver-removal UAF precedent, PR:L.\nUI:N - No victim interaction is required beyond routine driver removal, module unload, or hypervisor VNIC hot-unplug; monitoring and network traffic on the live interface can schedule tx_hang_reset during teardown without cooperation.\nS:U - Impact is use-after-free of netdev_priv enic memory in the host/guest kernel, enabling crash or privilege escalation within the same kernel security authority; it does not cross VM, hypervisor, IOMMU, or container boundaries.\nC:H - enic_tx_hang_reset dereferences freed enic/netdev memory via container_of(work, struct enic, tx_hang_reset); UAF on the unified netdev slab enables arbitrary kernel memory disclosure once the object is reallocated.\nI:H - The scheduled work performs hang reset, stop/open, and notifier calls through the dangling enic pointer, giving attacker-influenced writes and control-flow hijack primitives typical of netdev driver UAF exploitation.\nA:H - Use-after-free during enic_tx_hang_reset reliably causes kernel oops/panic when the work runs after free_netdev(), and even attempted exploitation crashes the system on dangling enic/netdev accesses."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T05:42:05.934Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8619865f34fb3b130b567855382a5c4aadd522b9"
        },
        {
          "url": "https://git.kernel.org/stable/c/e506e704b74748ffd0e1c92a7453ca2a959f832b"
        },
        {
          "url": "https://git.kernel.org/stable/c/4f3464fc6c1f26afc504fd525c574f2bc14c9d42"
        },
        {
          "url": "https://git.kernel.org/stable/c/ec680ea4ba1bca92a767fb7e7869758bfdd886e3"
        }
      ],
      "title": "enic: fix tx_hang_reset use-after-free on device removal",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74725",
    "datePublished": "2026-08-22T15:33:16.460Z",
    "dateReserved": "2026-08-15T05:44:03.929Z",
    "dateUpdated": "2026-08-25T05:42:05.934Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74725",
      "date": "2026-09-16",
      "epss": "0.00125",
      "percentile": "0.02546"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-24T14:44:27.000Z",
      "cve": "CVE-2026-74725",
      "id": "msrc_CVE-2026-74725",
      "initial_release_date": "2026-08-24T01:11:00.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "enic: fix tx_hang_reset use-after-free on device removal",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-74725.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-74725\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-22T16:16:47.567\",\"lastModified\":\"2026-08-25T06:18:58.687\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nenic: fix tx_hang_reset use-after-free on device removal\\n\\nenic_remove() cancels the reset and change_mtu_work items but does not\\ncancel tx_hang_reset. A TX timeout that fires while the device is being\\nremoved can schedule enic_tx_hang_reset() so that it runs after\\nfree_netdev(), resulting in a use-after-free.\\n\\ncancel_work_sync() alone is not sufficient here: the still-live watchdog\\nand notify paths can re-schedule these work items in the window between\\nthe cancel and unregister_netdev(). Use disable_work_sync(), which\\ncancels the work and blocks any subsequent schedule_work() from\\nrequeuing it, and apply it to the reset and change_mtu_work items as\\nwell so the same requeue race is closed for all teardown work.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/ethernet/cisco/enic/enic_main.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"937317c7c1097aa878a5000e3aab616eb5c590c0\",\"lessThan\":\"8619865f34fb3b130b567855382a5c4aadd522b9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"937317c7c1097aa878a5000e3aab616eb5c590c0\",\"lessThan\":\"e506e704b74748ffd0e1c92a7453ca2a959f832b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"937317c7c1097aa878a5000e3aab616eb5c590c0\",\"lessThan\":\"4f3464fc6c1f26afc504fd525c574f2bc14c9d42\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"937317c7c1097aa878a5000e3aab616eb5c590c0\",\"lessThan\":\"ec680ea4ba1bca92a767fb7e7869758bfdd886e3\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/ethernet/cisco/enic/enic_main.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.4\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.4\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.104\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.45\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.9\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/4f3464fc6c1f26afc504fd525c574f2bc14c9d42\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/8619865f34fb3b130b567855382a5c4aadd522b9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e506e704b74748ffd0e1c92a7453ca2a959f832b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ec680ea4ba1bca92a767fb7e7869758bfdd886e3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-25T08:56:16+00:00",
      "cve": "CVE-2026-74725",
      "id": "CVE-2026-74725",
      "initial_release_date": "2026-08-22T00:00:00+00:00",
      "product_status:known_affected": "260",
      "product_status:known_not_affected": "14",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: enic: fix tx_hang_reset use-after-free on device removal",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74725.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T01:15:41Z",
      "cve": "CVE-2026-74725",
      "id": "CVE-2026-74725",
      "initial_release_date": "2026-08-26T01:11:41Z",
      "product_status:known_affected": "353",
      "product_status:known_not_affected": "4",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-74725",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-74725.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.