CVE-2025-40319 | BDVDB-2026-304337 Detail

Description#

In the Linux kernel, the following vulnerability has been resolved: bpf: Sync pending IRQ work before freeing ring buffer Fix a race where irq_work can be queued in bpf_ringbuf_commit() but the ring buffer is freed before the work executes. In the syzbot reproducer, a BPF program attached to sched_switch triggers bpf_ringbuf_commit(), queuing an irq_work. If the ring buffer is freed before this work executes, the irq_work thread may accesses freed memory. Calling `irq_work_sync(&rb->work)` ensures that all pending irq_work complete before freeing the buffer.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12025-12-08Record published in the CVE List.
2. Version 22026-10-15Most recent update recorded in the CVE List.