CVE-2025-40319

In the Linux kernel, the following vulnerability has been resolved: bpf: Sync pending IRQ work before freeing ring buffer Fix a race where irq_work can be queued in bpf_ringbuf_commit() but the ring buffer is freed before the work executes. In the syzbot reproducer, a BPF program attached to sched_switch triggers bpf_ringbuf_commit(), queuing an irq_work. If the ring buffer is freed before this work executes, the irq_work thread may accesses freed memory. Calling `irq_work_sync(&rb->work)` ensures that all pending irq_work complete before freeing the buffer.

CVSS 3.1

7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.1% chance of exploitation in the next 30 days; higher than 3% of CVEs (scores of 2026-10-25)

Published

2025-12-08

Modified

2026-10-15

Record from

the NVD, synced 2026-10-19

References

• https://git.kernel.org/stable/c/10ca3b2eec384628bc9f5d8190aed9427ad2dde6
• https://git.kernel.org/stable/c/430e15544f11f8de26b2b5109c7152f71b78295e
• https://git.kernel.org/stable/c/47626748a2a00068dbbd5836d19076637b4e235b
• https://git.kernel.org/stable/c/4e9077638301816a7d73fa1e1b4c1db4a7e3b59c
• https://git.kernel.org/stable/c/6451141103547f4efd774e912418a3b4318046c6

Check your stackJSON