CVE-2026-74725

The Linux kernel contains a use‑after‑free flaw in the enic network driver when a device is removed. During device teardown, the tx_hang_reset work item is not cancelled, which allows a TX timeout to fire after the device struct has been freed. The resulting use‑after‑free can corrupt kernel memory, potentially leading to a crash or arbitrary code execution with kernel privileges. This weakness is a classic example of an internal kernel race condition that can be leveraged by an attacker who can influence device removal or generate a timeout.

Linux Kernel. No specific affected kernel versions are listed in the CVE data; the issue applies to any kernel build containing the enic driver prior to the fix committed in the referenced patches.

Because the flaw is a use‑after‑free in kernel space, the CVSS score of 7.8 indicates a high‑severity vulnerability that can lead to privilege escalation or denial of service. The EPSS score of < 1% suggests a very low probability of exploitation at this time, and the vulnerability is not listed in CISA’s KEV catalog. Nevertheless, the kernel’s critical role means that any successful exploitation could have catastrophic impact.