In the Linux kernel, the following vulnerability has been resolved:
bpf: Sync pending IRQ work before freeing ring buffer
Fix a race where irqwork can be queued in bpfringbufcommit()
but the ring buffer is freed before the work executes.
In the syzbot reproducer, a BPF program attached to schedswitch
triggers bpfringbufcommit(), queuing an irqwork. If the ring buffer
is freed before this work executes, the irqwork thread may accesses
freed memory.
Calling irq_work_sync(&rb->work) ensures that all pending irq_work
complete before freeing the buffer.
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/40xxx/CVE-2025-40319.json",
"cna_assigner": "Linux"
}