EUVD-2026-64412
GHSA-r6pf-7wx9-37hw
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Race condition between TX timeout and device removal requires precise timing, warranting AC:H over the vendor-assigned AC:L; all other metrics align.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
enic: fix tx_hang_reset use-after-free on device removal
enic_remove() cancels the reset and change_mtu_work items but does not cancel tx_hang_reset. A TX timeout that fires while the device is being removed can schedule enic_tx_hang_reset() so that it runs after free_netdev(), resulting in a use-after-free.
cancel_work_sync() alone is not sufficient here: the still-live watchdog and notify paths can re-schedule these work items in the window between the cancel and unregister_netdev(). Use disable_work_sync(), which cancels the work and blocks any subsequent schedule_work() from requeuing it, and apply it to the reset and change_mtu_work items as well so the same requeue race is closed for all teardown work.
AnalysisAI
Use-after-free in the Linux kernel's enic driver (Cisco VIC Ethernet NIC) allows a local attacker with low privileges to corrupt kernel heap memory during network device removal. The enic_remove() teardown function fails to cancel or disable the tx_hang_reset work item, creating a race window where a TX watchdog timeout can reschedule enic_tx_hang_reset() to execute after free_netdev() has already released the underlying network device structure. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following: a Linux kernel version between the introducing commit 937317c7c1097aa878a5000e3aab616eb5c590c0 and the respective stable fix commits; a Cisco VIC Ethernet NIC managed by the enic driver (systems without this hardware are entirely unaffected); local authenticated access with at least low-privilege credentials (PR:L per CVSS vector); and the ability to concurrently induce a TX watchdog timeout and device removal within a precise timing window. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Real-world exploitation risk is substantially lower than the 7.8 CVSS score suggests. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local user on a Cisco UCS server with low-privilege credentials saturates the NIC to trigger the TX watchdog timeout, then simultaneously initiates removal of the enic network device via driver unbind or physical hot-removal. If the TX timeout fires and schedules enic_tx_hang_reset() in the narrow window after enic_remove() begins but before free_netdev() completes, the work item executes against already-freed kernel memory, potentially enabling heap manipulation and local privilege escalation to root. … |
| Remediation | Update to a patched Linux kernel stable release: 6.12.104 or later in the 6.12.x series, 6.18.45 or later in the 6.18.x series, 7.1.9 or later in the 7.1.x series, or 7.2 and later in the mainline series. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit your Linux infrastructure to identify systems running the enic driver on Cisco VIC Ethernet NICs and document current kernel versions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today