{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74725", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.929Z", "datePublished": "2026-08-22T15:33:16.460Z", "dateUpdated": "2026-08-25T05:42:05.934Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-25T05:42:05.934Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nenic: fix tx_hang_reset use-after-free on device removal\n\nenic_remove() cancels the reset and change_mtu_work items but does not\ncancel tx_hang_reset. A TX timeout that fires while the device is being\nremoved can schedule enic_tx_hang_reset() so that it runs after\nfree_netdev(), resulting in a use-after-free.\n\ncancel_work_sync() alone is not sufficient here: the still-live watchdog\nand notify paths can re-schedule these work items in the window between\nthe cancel and unregister_netdev(). Use disable_work_sync(), which\ncancels the work and blocks any subsequent schedule_work() from\nrequeuing it, and apply it to the reset and change_mtu_work items as\nwell so the same requeue race is closed for all teardown work."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The UAF occurs during enic_remove() PCI/driver teardown (sysfs unbind, rmmod, or hot-unplug); TX timeout is raised by the local netdev watchdog, not by remote packet processing, and there is no standalone network path into enic_remove itself.\nAC:L - This is a workqueue race during removal: once teardown starts the netdev can still be up so the watchdog schedules enic_tx_hang_reset, and an attacker can reliably drive TX timeout by stalling or flooding xmit on the still-registered interface while removal proceeds.\nPR:L - PCI unbind/module unload needs elevated privileges, but an unprivileged local or tenant workload can supply the concurrent netdev watchdog TX timeout (local/remote traffic on the Cisco VIC uplink) that schedules tx_hang_reset; per driver-removal UAF precedent, PR:L.\nUI:N - No victim interaction is required beyond routine driver removal, module unload, or hypervisor VNIC hot-unplug; monitoring and network traffic on the live interface can schedule tx_hang_reset during teardown without cooperation.\nS:U - Impact is use-after-free of netdev_priv enic memory in the host/guest kernel, enabling crash or privilege escalation within the same kernel security authority; it does not cross VM, hypervisor, IOMMU, or container boundaries.\nC:H - enic_tx_hang_reset dereferences freed enic/netdev memory via container_of(work, struct enic, tx_hang_reset); UAF on the unified netdev slab enables arbitrary kernel memory disclosure once the object is reallocated.\nI:H - The scheduled work performs hang reset, stop/open, and notifier calls through the dangling enic pointer, giving attacker-influenced writes and control-flow hijack primitives typical of netdev driver UAF exploitation.\nA:H - Use-after-free during enic_tx_hang_reset reliably causes kernel oops/panic when the work runs after free_netdev(), and even attempted exploitation crashes the system on dangling enic/netdev accesses."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/cisco/enic/enic_main.c"], "versions": [{"version": "937317c7c1097aa878a5000e3aab616eb5c590c0", "lessThan": "8619865f34fb3b130b567855382a5c4aadd522b9", "status": "affected", "versionType": "git"}, {"version": "937317c7c1097aa878a5000e3aab616eb5c590c0", "lessThan": "e506e704b74748ffd0e1c92a7453ca2a959f832b", "status": "affected", "versionType": "git"}, {"version": "937317c7c1097aa878a5000e3aab616eb5c590c0", "lessThan": "4f3464fc6c1f26afc504fd525c574f2bc14c9d42", "status": "affected", "versionType": "git"}, {"version": "937317c7c1097aa878a5000e3aab616eb5c590c0", "lessThan": "ec680ea4ba1bca92a767fb7e7869758bfdd886e3", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/cisco/enic/enic_main.c"], "versions": [{"version": "4.4", "status": "affected"}, {"version": "0", "lessThan": "4.4", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.104", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.45", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.9", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4", "versionEndExcluding": "6.12.104"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4", "versionEndExcluding": "6.18.45"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4", "versionEndExcluding": "7.1.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/8619865f34fb3b130b567855382a5c4aadd522b9"}, {"url": "https://git.kernel.org/stable/c/e506e704b74748ffd0e1c92a7453ca2a959f832b"}, {"url": "https://git.kernel.org/stable/c/4f3464fc6c1f26afc504fd525c574f2bc14c9d42"}, {"url": "https://git.kernel.org/stable/c/ec680ea4ba1bca92a767fb7e7869758bfdd886e3"}], "title": "enic: fix tx_hang_reset use-after-free on device removal", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/ethernet/cisco/enic/enic_main.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "8619865f34fb3b130b567855382a5c4aadd522b9", "status": "affected", "version": "937317c7c1097aa878a5000e3aab616eb5c590c0", "versionType": "git"}, {"lessThan": "e506e704b74748ffd0e1c92a7453ca2a959f832b", "status": "affected", "version": "937317c7c1097aa878a5000e3aab616eb5c590c0", "versionType": "git"}, {"lessThan": "4f3464fc6c1f26afc504fd525c574f2bc14c9d42", "status": "affected", "version": "937317c7c1097aa878a5000e3aab616eb5c590c0", "versionType": "git"}, {"lessThan": "ec680ea4ba1bca92a767fb7e7869758bfdd886e3", "status": "affected", "version": "937317c7c1097aa878a5000e3aab616eb5c590c0", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/ethernet/cisco/enic/enic_main.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.4"}, {"lessThan": "4.4", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.104", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.45", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nenic: fix tx_hang_reset use-after-free on device removal\n\nenic_remove() cancels the reset and change_mtu_work items but does not\ncancel tx_hang_reset. A TX timeout that fires while the device is being\nremoved can schedule enic_tx_hang_reset() so that it runs after\nfree_netdev(), resulting in a use-after-free.\n\ncancel_work_sync() alone is not sufficient here: the still-live watchdog\nand notify paths can re-schedule these work items in the window between\nthe cancel and unregister_netdev(). Use disable_work_sync(), which\ncancels the work and blocks any subsequent schedule_work() from\nrequeuing it, and apply it to the reset and change_mtu_work items as\nwell so the same requeue race is closed for all teardown work."}], "id": "CVE-2026-74725", "lastModified": "2026-08-25T06:18:58.687", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-08-22T16:16:47.567", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4f3464fc6c1f26afc504fd525c574f2bc14c9d42"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8619865f34fb3b130b567855382a5c4aadd522b9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e506e704b74748ffd0e1c92a7453ca2a959f832b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ec680ea4ba1bca92a767fb7e7869758bfdd886e3"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: enic: fix tx_hang_reset use-after-free on device removal", "id": "2521492", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2521492"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-364", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nenic: fix tx_hang_reset use-after-free on device removal\nenic_remove() cancels the reset and change_mtu_work items but does not\ncancel tx_hang_reset. A TX timeout that fires while the device is being\nremoved can schedule enic_tx_hang_reset() so that it runs after\nfree_netdev(), resulting in a use-after-free.\ncancel_work_sync() alone is not sufficient here: the still-live watchdog\nand notify paths can re-schedule these work items in the window between\nthe cancel and unregister_netdev(). Use disable_work_sync(), which\ncancels the work and blocks any subsequent schedule_work() from\nrequeuing it, and apply it to the reset and change_mtu_work items as\nwell so the same requeue race is closed for all teardown work.", "A flaw was found in the Linux kernel's enic driver. During device removal, a timing issue can occur where a transmit (TX) timeout schedules a reset operation after the device's memory has been freed. This leads to a use-after-free vulnerability, a type of memory corruption where the system attempts to access memory that is no longer allocated. This can result in system instability, crashes, or potentially allow an attacker to execute arbitrary code."], "name": "CVE-2026-74725", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-22T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-74725\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74725\nhttps://lore.kernel.org/linux-cve-announce/2026082240-CVE-2026-74725-d59d@gregkh/T"], "threat_severity": "Moderate"}