CVE-2026-74725

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> enic: fix tx_hang_reset use-after-free on device removal<br /> <br /> enic_remove() cancels the reset and change_mtu_work items but does not<br /> cancel tx_hang_reset. A TX timeout that fires while the device is being<br /> removed can schedule enic_tx_hang_reset() so that it runs after<br /> free_netdev(), resulting in a use-after-free.<br /> <br /> cancel_work_sync() alone is not sufficient here: the still-live watchdog<br /> and notify paths can re-schedule these work items in the window between<br /> the cancel and unregister_netdev(). Use disable_work_sync(), which<br /> cancels the work and blocks any subsequent schedule_work() from<br /> requeuing it, and apply it to the reset and change_mtu_work items as<br /> well so the same requeue race is closed for all teardown work.