CVE-2026-74725 (GCVE-0-2026-74725)
Vulnerability from cvelistv5 – Published: 2026-08-22 15:33 – Updated: 2026-10-16 19:16
VLAI
EPSS
VEX
Title
enic: fix tx_hang_reset use-after-free on device removal
Summary
In the Linux kernel, the following vulnerability has been resolved:
enic: fix tx_hang_reset use-after-free on device removal
enic_remove() cancels the reset and change_mtu_work items but does not
cancel tx_hang_reset. A TX timeout that fires while the device is being
removed can schedule enic_tx_hang_reset() so that it runs after
free_netdev(), resulting in a use-after-free.
cancel_work_sync() alone is not sufficient here: the still-live watchdog
and notify paths can re-schedule these work items in the window between
the cancel and unregister_netdev(). Use disable_work_sync(), which
cancels the work and blocks any subsequent schedule_work() from
requeuing it, and apply it to the reset and change_mtu_work items as
well so the same requeue race is closed for all teardown work.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 19:15 UTC
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
937317c7c1097aa878a5000e3aab616eb5c590c0 , < 8619865f34fb3b130b567855382a5c4aadd522b9
(git)
Affected: 937317c7c1097aa878a5000e3aab616eb5c590c0 , < e506e704b74748ffd0e1c92a7453ca2a959f832b (git) Affected: 937317c7c1097aa878a5000e3aab616eb5c590c0 , < 4f3464fc6c1f26afc504fd525c574f2bc14c9d42 (git) Affected: 937317c7c1097aa878a5000e3aab616eb5c590c0 , < ec680ea4ba1bca92a767fb7e7869758bfdd886e3 (git) |
guessed | |
| Linux | Linux |
Affected:
4.4
Unaffected: 0 , < 4.4 (semver) Unaffected: 6.12.104 , ≤ 6.12.* (semver) Unaffected: 6.18.45 , ≤ 6.18.* (semver) Unaffected: 7.1.9 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
guessed |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74725",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:15:41.206988Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:16:12.099Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/cisco/enic/enic_main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8619865f34fb3b130b567855382a5c4aadd522b9",
"status": "affected",
"version": "937317c7c1097aa878a5000e3aab616eb5c590c0",
"versionType": "git"
},
{
"lessThan": "e506e704b74748ffd0e1c92a7453ca2a959f832b",
"status": "affected",
"version": "937317c7c1097aa878a5000e3aab616eb5c590c0",
"versionType": "git"
},
{
"lessThan": "4f3464fc6c1f26afc504fd525c574f2bc14c9d42",
"status": "affected",
"version": "937317c7c1097aa878a5000e3aab616eb5c590c0",
"versionType": "git"
},
{
"lessThan": "ec680ea4ba1bca92a767fb7e7869758bfdd886e3",
"status": "affected",
"version": "937317c7c1097aa878a5000e3aab616eb5c590c0",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/cisco/enic/enic_main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.4"
},
{
"lessThan": "4.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.104",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.104",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.45",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nenic: fix tx_hang_reset use-after-free on device removal\n\nenic_remove() cancels the reset and change_mtu_work items but does not\ncancel tx_hang_reset. A TX timeout that fires while the device is being\nremoved can schedule enic_tx_hang_reset() so that it runs after\nfree_netdev(), resulting in a use-after-free.\n\ncancel_work_sync() alone is not sufficient here: the still-live watchdog\nand notify paths can re-schedule these work items in the window between\nthe cancel and unregister_netdev(). Use disable_work_sync(), which\ncancels the work and blocks any subsequent schedule_work() from\nrequeuing it, and apply it to the reset and change_mtu_work items as\nwell so the same requeue race is closed for all teardown work."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The UAF occurs during enic_remove() PCI/driver teardown (sysfs unbind, rmmod, or hot-unplug); TX timeout is raised by the local netdev watchdog, not by remote packet processing, and there is no standalone network path into enic_remove itself.\nAC:L - This is a workqueue race during removal: once teardown starts the netdev can still be up so the watchdog schedules enic_tx_hang_reset, and an attacker can reliably drive TX timeout by stalling or flooding xmit on the still-registered interface while removal proceeds.\nPR:L - PCI unbind/module unload needs elevated privileges, but an unprivileged local or tenant workload can supply the concurrent netdev watchdog TX timeout (local/remote traffic on the Cisco VIC uplink) that schedules tx_hang_reset; per driver-removal UAF precedent, PR:L.\nUI:N - No victim interaction is required beyond routine driver removal, module unload, or hypervisor VNIC hot-unplug; monitoring and network traffic on the live interface can schedule tx_hang_reset during teardown without cooperation.\nS:U - Impact is use-after-free of netdev_priv enic memory in the host/guest kernel, enabling crash or privilege escalation within the same kernel security authority; it does not cross VM, hypervisor, IOMMU, or container boundaries.\nC:H - enic_tx_hang_reset dereferences freed enic/netdev memory via container_of(work, struct enic, tx_hang_reset); UAF on the unified netdev slab enables arbitrary kernel memory disclosure once the object is reallocated.\nI:H - The scheduled work performs hang reset, stop/open, and notifier calls through the dangling enic pointer, giving attacker-influenced writes and control-flow hijack primitives typical of netdev driver UAF exploitation.\nA:H - Use-after-free during enic_tx_hang_reset reliably causes kernel oops/panic when the work runs after free_netdev(), and even attempted exploitation crashes the system on dangling enic/netdev accesses."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T05:42:05.934Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8619865f34fb3b130b567855382a5c4aadd522b9"
},
{
"url": "https://git.kernel.org/stable/c/e506e704b74748ffd0e1c92a7453ca2a959f832b"
},
{
"url": "https://git.kernel.org/stable/c/4f3464fc6c1f26afc504fd525c574f2bc14c9d42"
},
{
"url": "https://git.kernel.org/stable/c/ec680ea4ba1bca92a767fb7e7869758bfdd886e3"
}
],
"title": "enic: fix tx_hang_reset use-after-free on device removal",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74725",
"datePublished": "2026-08-22T15:33:16.460Z",
"dateReserved": "2026-08-15T05:44:03.929Z",
"dateUpdated": "2026-10-16T19:16:12.099Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-74725",
"date": "2026-11-01",
"epss": "0.00125",
"percentile": "0.02184"
},
"microsoft_vex": {
"current_release_date": "2026-11-01T15:04:13.000Z",
"cve": "CVE-2026-74725",
"id": "msrc_CVE-2026-74725",
"initial_release_date": "2026-08-24T01:11:00.000Z",
"product_status:known_affected": "4",
"source": "Microsoft CSAF VEX",
"status": "final",
"title": "enic: fix tx_hang_reset use-after-free on device removal",
"url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-74725.json",
"version": "6"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/cisco/enic/enic_main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8619865f34fb3b130b567855382a5c4aadd522b9",
"status": "affected",
"version": "937317c7c1097aa878a5000e3aab616eb5c590c0",
"versionType": "git"
},
{
"lessThan": "e506e704b74748ffd0e1c92a7453ca2a959f832b",
"status": "affected",
"version": "937317c7c1097aa878a5000e3aab616eb5c590c0",
"versionType": "git"
},
{
"lessThan": "4f3464fc6c1f26afc504fd525c574f2bc14c9d42",
"status": "affected",
"version": "937317c7c1097aa878a5000e3aab616eb5c590c0",
"versionType": "git"
},
{
"lessThan": "ec680ea4ba1bca92a767fb7e7869758bfdd886e3",
"status": "affected",
"version": "937317c7c1097aa878a5000e3aab616eb5c590c0",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/cisco/enic/enic_main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.4"
},
{
"lessThan": "4.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.104",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nenic: fix tx_hang_reset use-after-free on device removal\n\nenic_remove() cancels the reset and change_mtu_work items but does not\ncancel tx_hang_reset. A TX timeout that fires while the device is being\nremoved can schedule enic_tx_hang_reset() so that it runs after\nfree_netdev(), resulting in a use-after-free.\n\ncancel_work_sync() alone is not sufficient here: the still-live watchdog\nand notify paths can re-schedule these work items in the window between\nthe cancel and unregister_netdev(). Use disable_work_sync(), which\ncancels the work and blocks any subsequent schedule_work() from\nrequeuing it, and apply it to the reset and change_mtu_work items as\nwell so the same requeue race is closed for all teardown work."
},
{
"lang": "es",
"value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nenic: corrige el uso despu\u00e9s de liberaci\u00f3n de tx_hang_reset al retirar el dispositivo\n\nenic_remove() cancela los elementos de trabajo reset y change_mtu_work pero no cancela tx_hang_reset. Un tiempo de espera de TX que se activa mientras se retira el dispositivo puede programar enic_tx_hang_reset() para que se ejecute despu\u00e9s de free_netdev(), lo que resulta en un uso despu\u00e9s de liberaci\u00f3n.\n\ncancel_work_sync() por s\u00ed solo no es suficiente aqu\u00ed: las rutas de watchdog y notify a\u00fan activas pueden reprogramar estos elementos de trabajo en la ventana entre la cancelaci\u00f3n y unregister_netdev(). Utilice disable_work_sync(), que cancela el trabajo y bloquea cualquier schedule_work() posterior de volver a encolarlo, y apl\u00edquelo tambi\u00e9n a los elementos de trabajo reset y change_mtu_work para que la misma condici\u00f3n de carrera de reencolado se cierre para todo el trabajo de desmontaje."
}
],
"id": "CVE-2026-74725",
"lastModified": "2026-10-16T20:17:54.887",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-74725",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:15:41.206988Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-08-22T16:16:47.567",
"references": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/4f3464fc6c1f26afc504fd525c574f2bc14c9d42"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/8619865f34fb3b130b567855382a5c4aadd522b9"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/e506e704b74748ffd0e1c92a7453ca2a959f832b"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/ec680ea4ba1bca92a767fb7e7869758bfdd886e3"
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"vulnStatus": "Received"
}
},
"redhat_vex": {
"aggregate_severity": "Moderate",
"current_release_date": "2026-10-17T21:14:17+00:00",
"cve": "CVE-2026-74725",
"id": "CVE-2026-74725",
"initial_release_date": "2026-08-22T00:00:00+00:00",
"product_status:known_affected": "261",
"product_status:known_not_affected": "14",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "kernel: enic: fix tx_hang_reset use-after-free on device removal",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74725.json",
"version": "3"
},
"vulnrichment": {
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74725",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:15:41.206988Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:15:42.587Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/cisco/enic/enic_main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8619865f34fb3b130b567855382a5c4aadd522b9",
"status": "affected",
"version": "937317c7c1097aa878a5000e3aab616eb5c590c0",
"versionType": "git"
},
{
"lessThan": "e506e704b74748ffd0e1c92a7453ca2a959f832b",
"status": "affected",
"version": "937317c7c1097aa878a5000e3aab616eb5c590c0",
"versionType": "git"
},
{
"lessThan": "4f3464fc6c1f26afc504fd525c574f2bc14c9d42",
"status": "affected",
"version": "937317c7c1097aa878a5000e3aab616eb5c590c0",
"versionType": "git"
},
{
"lessThan": "ec680ea4ba1bca92a767fb7e7869758bfdd886e3",
"status": "affected",
"version": "937317c7c1097aa878a5000e3aab616eb5c590c0",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/cisco/enic/enic_main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.4"
},
{
"lessThan": "4.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.104",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.104",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.45",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "4.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nenic: fix tx_hang_reset use-after-free on device removal\n\nenic_remove() cancels the reset and change_mtu_work items but does not\ncancel tx_hang_reset. A TX timeout that fires while the device is being\nremoved can schedule enic_tx_hang_reset() so that it runs after\nfree_netdev(), resulting in a use-after-free.\n\ncancel_work_sync() alone is not sufficient here: the still-live watchdog\nand notify paths can re-schedule these work items in the window between\nthe cancel and unregister_netdev(). Use disable_work_sync(), which\ncancels the work and blocks any subsequent schedule_work() from\nrequeuing it, and apply it to the reset and change_mtu_work items as\nwell so the same requeue race is closed for all teardown work."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The UAF occurs during enic_remove() PCI/driver teardown (sysfs unbind, rmmod, or hot-unplug); TX timeout is raised by the local netdev watchdog, not by remote packet processing, and there is no standalone network path into enic_remove itself.\nAC:L - This is a workqueue race during removal: once teardown starts the netdev can still be up so the watchdog schedules enic_tx_hang_reset, and an attacker can reliably drive TX timeout by stalling or flooding xmit on the still-registered interface while removal proceeds.\nPR:L - PCI unbind/module unload needs elevated privileges, but an unprivileged local or tenant workload can supply the concurrent netdev watchdog TX timeout (local/remote traffic on the Cisco VIC uplink) that schedules tx_hang_reset; per driver-removal UAF precedent, PR:L.\nUI:N - No victim interaction is required beyond routine driver removal, module unload, or hypervisor VNIC hot-unplug; monitoring and network traffic on the live interface can schedule tx_hang_reset during teardown without cooperation.\nS:U - Impact is use-after-free of netdev_priv enic memory in the host/guest kernel, enabling crash or privilege escalation within the same kernel security authority; it does not cross VM, hypervisor, IOMMU, or container boundaries.\nC:H - enic_tx_hang_reset dereferences freed enic/netdev memory via container_of(work, struct enic, tx_hang_reset); UAF on the unified netdev slab enables arbitrary kernel memory disclosure once the object is reallocated.\nI:H - The scheduled work performs hang reset, stop/open, and notifier calls through the dangling enic pointer, giving attacker-influenced writes and control-flow hijack primitives typical of netdev driver UAF exploitation.\nA:H - Use-after-free during enic_tx_hang_reset reliably causes kernel oops/panic when the work runs after free_netdev(), and even attempted exploitation crashes the system on dangling enic/netdev accesses."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T05:42:05.934Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8619865f34fb3b130b567855382a5c4aadd522b9"
},
{
"url": "https://git.kernel.org/stable/c/e506e704b74748ffd0e1c92a7453ca2a959f832b"
},
{
"url": "https://git.kernel.org/stable/c/4f3464fc6c1f26afc504fd525c574f2bc14c9d42"
},
{
"url": "https://git.kernel.org/stable/c/ec680ea4ba1bca92a767fb7e7869758bfdd886e3"
}
],
"title": "enic: fix tx_hang_reset use-after-free on device removal",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74725",
"datePublished": "2026-08-22T15:33:16.460Z",
"dateReserved": "2026-08-15T05:44:03.929Z",
"dateUpdated": "2026-10-16T19:16:12.099Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.