enic: fix tx_hang_reset use-after-free on device removal (Linux Linux)

CVE-2026-74725
HIGH 7.8

En bref

Source
NVD
EPSS
EPSS 0.13 % · centile 2 ()
État
PUBLISHED
Publiée
Mise à jour
Attribuée par
Linux
Statut NVD
Received

Description

In the Linux kernel, the following vulnerability has been resolved: enic: fix tx_hang_reset use-after-free on device removal enic_remove() cancels the reset and change_mtu_work items but does not cancel tx_hang_reset. A TX timeout that fires while the device is being removed can schedule enic_tx_hang_reset() so that it runs after free_netdev(), resulting in a use-after-free. cancel_work_sync() alone is not sufficient here: the still-live watchdog and notify paths can re-schedule these work items in the window between the cancel and unregister_netdev(). Use disable_work_sync(), which cancels the work and blocks any subsequent schedule_work() from requeuing it, and apply it to the reset and change_mtu_work items as well so the same requeue race is closed for all teardown work.

Références

Scores

VersionScoreVecteurÉvalué par
CVSS 3.1HIGH 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HLinux
CVSS 3.1HIGH 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HNVD · 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (Secondary)

Références européennes

Avis du CERT-FR

Produits affectés

ProduitVersions
Linux · Linuxaffected 937317c7c1097aa878a5000e3aab616eb5c590c0 < 8619865f34fb3b130b567855382a5c4aadd522b9 ; affected 937317c7c1097aa878a5000e3aab616eb5c590c0 < e506e704b74748ffd0e1c92a7453ca2a959f832b ; affected 937317c7c1097aa878a5000e3aab616eb5c590c0 < 4f3464fc6c1f26afc504fd525c574f2bc14c9d42 ; affected 937317c7c1097aa878a5000e3aab616eb5c590c0 < ec680ea4ba1bca92a767fb7e7869758bfdd886e3
Linux · Linuxaffected 4.4 ; unaffected 0 < 4.4 ; unaffected 6.12.104 ≤ 6.12.* ; unaffected 6.18.45 ≤ 6.18.* ; unaffected 7.1.9 ≤ 7.1.* ; unaffected 7.2 ≤ *

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD