The Linux kernel enic driver had a use-after-free vulnerability (CVE-2026-74725) caused by incomplete cancellation of work items during device removal. Specifically, enic_remove() cancels reset and change_mtu_work items but not tx_hang_reset. If a TX timeout triggers while the device is being removed, enic_tx_hang_reset() could be scheduled after free_netdev(), leading to use-after-free. The fix replaces cancel_work_sync() with disable_work_sync() for all teardown work items to prevent rescheduling races.

This vulnerability could cause use-after-free conditions in the kernel, potentially leading to system instability or crashes. No information about exploitation in the wild or privilege escalation is provided.

A fix is available that replaces cancel_work_sync() with disable_work_sync() in the enic driver to properly cancel and block rescheduling of work items during device removal. Users should apply the official kernel updates that include this fix. Patch status is not explicitly confirmed in the provided data; check the vendor advisory for current remediation guidance.