CVE-2025-40319

In the Linux kernel, the following vulnerability has been resolved:

bpf: Sync pending IRQ work before freeing ring buffer

Fix a race where irq_work can be queued in bpf_ringbuf_commit() but the ring buffer is freed before the work executes. In the syzbot reproducer, a BPF program attached to sched_switch triggers bpf_ringbuf_commit(), queuing an irq_work. If the ring buffer is freed before this work executes, the irq_work thread may accesses freed memory. Calling irq_work_sync(&rb->work) ensures that all pending irq_work complete before freeing the buffer.

This vulnerability is rated as Moderate severity because exploitation requires local access with elevated privileges to load and attach custom BPF programs that interact with ring buffers. In default Red Hat Enterprise Linux installations, unprivileged user access to the BPF subsystem is restricted, limiting exposure to administrators or containers with extended capabilities. A successful attack relies on winning a timing race during buffer cleanup, which primarily leads to a kernel crash and denial of service rather than arbitrary code execution.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.