UBUNTU-CVE-2026-74725: Use After Free
In the Linux kernel, the following vulnerability has been resolved: enic: fix txhangreset use-after-free on device removal enicremove() cancels the reset and changemtuwork items but does not cancel txhangreset. A TX timeout that fires while the device is being removed can schedule enictxhangreset() so that it runs after freenetdev(), resulting in a use-after-free. cancelworksync() alone is not sufficient here: the still-live watchdog and notify paths can re-schedule these work items in the window between the cancel and unregisternetdev(). Use disableworksync(), which cancels the work and blocks any subsequent schedulework() from requeuing it, and apply it to the reset and changemtuwork items as well so the same requeue race is closed for all teardown work.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegrato a version that resolves this vulnerability.Fixed in 6.8.0-1036.39 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Configuration
In enic_remove(), use disable_work_sync() for tx_hang_reset, reset, and change_mtu_work so the work is cancelled and cannot be requeued during device teardown.
Linux kernel enic driver teardown work cancellation = disable_work_sync()
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the enic network driver are relevant, particularly when an enic-backed network device is removed. The affected software list includes Ubuntu linux, linux-aws, linux-azure, linux-gcp, and their listed FIPS kernel variants.
What level of access does an attacker need?
The severity vector identifies local access and low privileges as required, with no user interaction. Successful exploitation could affect confidentiality, integrity, and availability.
What condition triggers the vulnerable path?
A transmit timeout must occur while the device is being removed, allowing TX-hang reset work to be queued after network-device memory has been freed. The issue is a teardown race involving work items that can be rescheduled by watchdog or notification paths.
Is there a configuration-only mitigation described?
No operational configuration workaround is provided. The described code-level remediation replaces cancellation with disable_work_sync() for the relevant teardown work items so they cannot be requeued during device removal.