CVE-2026-74725 Overview
CVE-2026-74725 is a use-after-free vulnerability in the Linux kernel enic network driver for Cisco VIC Ethernet NICs. The flaw resides in the device removal path, where enic_remove() cancels the reset and change_mtu_work items but fails to cancel tx_hang_reset. A TX timeout occurring during device teardown can schedule enic_tx_hang_reset() to run after free_netdev(), producing a use-after-free condition on freed kernel memory.
Critical Impact
A local attacker with the ability to trigger device teardown and TX timeouts can exploit the freed memory reference to cause kernel memory corruption, denial of service, or potential local privilege escalation.
Affected Products
- Linux kernel builds containing the Cisco enic (VIC Ethernet) driver prior to the fix
- Distributions shipping the affected drivers/net/ethernet/cisco/enic/ code
- Stable kernel trees referenced by commits 4f3464f, 8619865, e506e70, and ec680ea
Discovery Timeline
- 2026-08-22 - CVE-2026-74725 published to NVD
- 2026-08-25 - Last updated in NVD database
Technical Details for CVE-2026-74725
Vulnerability Analysis
The enic driver defines multiple workqueue items that operate on the struct enic device context. During teardown, enic_remove() invokes cancel_work_sync() on the reset and change_mtu_work items but omits the tx_hang_reset work item entirely. If the TX watchdog fires while the driver is being unloaded, the enic_tx_hang_reset() handler can execute after unregister_netdev() and free_netdev() have released the underlying memory.
Compounding the issue, cancel_work_sync() alone is insufficient. The still-live watchdog and notify paths can re-schedule the work items after the cancel call but before unregister_netdev() completes. This requeue race applies to all three teardown work items.
The upstream fix replaces cancel_work_sync() with disable_work_sync(), which both cancels the pending work and blocks any subsequent schedule_work() from requeuing it. The change is applied uniformly to reset, change_mtu_work, and tx_hang_reset.
Root Cause
The root cause is incomplete teardown synchronization in the enic_remove() function. The driver author did not enumerate tx_hang_reset alongside the other work items, and the cancel primitive used could not prevent requeuing from concurrent watchdog and notify code paths.
Attack Vector
Exploitation requires local access with privileges sufficient to trigger device removal (for example, module unload, PCI hot-unplug, or SR-IOV VF teardown) while concurrently inducing a TX timeout on the enic interface. The attacker races the watchdog against free_netdev() to invoke the work handler on freed memory.
The vulnerability manifests in the driver teardown sequence. See the referenced Kernel Git Commit ec680ea for the corrective patch.
Detection Methods for CVE-2026-74725
Indicators of Compromise
- Kernel oops or general protection fault messages referencing enic_tx_hang_reset in dmesg following a device removal event
- KASAN reports flagging use-after-free reads or writes in drivers/net/ethernet/cisco/enic/ during driver unload
- Unexpected kernel panics on hosts using Cisco VIC adapters during PCI hot-unplug or SR-IOV VF teardown
Detection Strategies
- Enable KASAN (Kernel Address Sanitizer) on test systems running the enic driver to surface use-after-free conditions during device removal testing
- Audit kernel logs for TX watchdog timeouts on enic interfaces coinciding with module unload or PCI removal events
- Compare running kernel commit hashes against the fix commits 4f3464f, 8619865, e506e70, and ec680ea to identify unpatched hosts
Monitoring Recommendations
- Forward kernel ring buffer events to a centralized logging pipeline and alert on BUG: and KASAN: strings referencing enic
- Track PCI hot-unplug and module unload events on hosts equipped with Cisco VIC hardware
- Monitor for unexpected host reboots or kernel panics on virtualization hosts running the affected driver
How to Mitigate CVE-2026-74725
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced in the git commits 4f3464f, 8619865, e506e70, and ec680ea as soon as vendor-supplied kernel updates become available
- Restrict local access and module-loading privileges on hosts running the enic driver to trusted administrators only
- Avoid dynamic removal of Cisco VIC devices, including SR-IOV VF teardown, on unpatched kernels
Patch Information
The fix replaces cancel_work_sync() with disable_work_sync() for the reset, change_mtu_work, and tx_hang_reset work items in enic_remove(). Refer to Kernel Git Commit 4f3464f, Kernel Git Commit 8619865, Kernel Git Commit e506e70, and Kernel Git Commit ec680ea for the stable tree backports. Rebuild and reboot into the patched kernel to apply the fix.
Workarounds
- Where patching is not immediately possible, avoid unloading or hot-unplugging the enic driver on production hosts
- Disable SR-IOV VF creation and teardown workflows on affected Cisco VIC adapters until the patched kernel is deployed
- Limit CAP_SYS_MODULE and PCI sysfs write access to reduce the local attack surface
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
