Threats Tagged 'cve-2025-40319'

A race condition vulnerability in the Linux kernel's BPF subsystem was resolved by ensuring synchronization of pending IRQ work before freeing the ring buffer. The issue could cause the irq_work thread to access freed memory if the ring buffer is freed before the queued irq_work executes. This vulnerability was triggered by a BPF program attached to sched_switch that calls bpf_ringbuf_commit(), queuing irq_work. The fix involves calling irq_work_sync() to wait for all pending irq_work to complete before freeing the buffer.

In the Linux kernel, the following vulnerability has been resolved: bpf: Sync pending IRQ work before freeing ring buffer Fix a race where irq_work can be queued in bpf_ringbuf_commit() but the ring buffer is freed before the work executes. In the syzbot reproducer, a BPF program attached to sched_switch triggers bpf_ringbuf_commit(), queuing an irq_work. If the ring buffer is freed before this work executes, the irq_work thread may accesses freed memory. Calling `irq_work_sync(&rb->work)` ensures that all pending irq_work complete before freeing the buffer.