Executive brief
The Linux kernel's enic network driver (used for Cisco VIC Ethernet adapters) contains a use-after-free vulnerability during device removal. When a network interface is unplugged or the driver unloads while a TX timeout is pending, a dangling work item can access freed memory, potentially causing a kernel crash or system instability.
Technical details
This is a use-after-free vulnerability in the enic driver's device removal path (enic_remove function). The root cause is that tx_hang_reset work item is not canceled during device cleanup, allowing a pending TX timeout handler to schedule enic_tx_hang_reset() to run after free_netdev() has already freed the network device. Additionally, cancel_work_sync() alone is insufficient because watchdog and notify paths can re-schedule work items in the window between cancellation and unregister_netdev(). The fix replaces cancel_work_sync() with disable_work_sync() for reset, tx_hang_reset, and change_mtu_work items, which atomically cancels pending work and blocks any future requeuing attempts. No authentication or user interaction is required; the vulnerability triggers automatically during device removal if a TX timeout fires at the right moment.
Affected products
- Linux Linux kernel enic driver component (affects multiple kernel versions)
Timeline
- 2026-08-22: disclosed
- 2026-07-27: patched: Fix committed upstream (commit ec680ea4ba1bca92a767fb7e7869758bfdd886e3)