Device Removal Vulnerability in Linux Kernel Affecting Enic Driver

CVE-2026-74725

What is CVE-2026-74725?

A vulnerability in the Linux kernel related to the Enic driver allows for a use-after-free situation during the removal of a device. The enic_remove() function can inadvertently leave scheduled work items like tx_hang_reset active while the device is being decommissioned. If a transmission timeout occurs during this process, it may execute enic_tx_hang_reset() after the device's memory has been freed, potentially leading to system instability. The kernel maintenance has since applied a fix using disable_work_sync() methodology to prevent this race condition and ensure safe cleanup of resources.

References