Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

nvd логотип

CVE-2025-40319

Опубликовано: 08 дек. 2025
Источник: nvd
EPSS Низкий

Описание

In the Linux kernel, the following vulnerability has been resolved:

bpf: Sync pending IRQ work before freeing ring buffer

Fix a race where irq_work can be queued in bpf_ringbuf_commit() but the ring buffer is freed before the work executes. In the syzbot reproducer, a BPF program attached to sched_switch triggers bpf_ringbuf_commit(), queuing an irq_work. If the ring buffer is freed before this work executes, the irq_work thread may accesses freed memory. Calling irq_work_sync(&rb->work) ensures that all pending irq_work complete before freeing the buffer.

EPSS

Процентиль: 19%
0.00061
Низкий

Дефекты

Связанные уязвимости

ubuntu
около 2 месяцев назад

In the Linux kernel, the following vulnerability has been resolved: bpf: Sync pending IRQ work before freeing ring buffer Fix a race where irq_work can be queued in bpf_ringbuf_commit() but the ring buffer is freed before the work executes. In the syzbot reproducer, a BPF program attached to sched_switch triggers bpf_ringbuf_commit(), queuing an irq_work. If the ring buffer is freed before this work executes, the irq_work thread may accesses freed memory. Calling `irq_work_sync(&rb->work)` ensures that all pending irq_work complete before freeing the buffer.

CVSS3: 7.8
msrc
около 2 месяцев назад

bpf: Sync pending IRQ work before freeing ring buffer

debian
около 2 месяцев назад

In the Linux kernel, the following vulnerability has been resolved: b ...

github
около 2 месяцев назад

In the Linux kernel, the following vulnerability has been resolved: bpf: Sync pending IRQ work before freeing ring buffer Fix a race where irq_work can be queued in bpf_ringbuf_commit() but the ring buffer is freed before the work executes. In the syzbot reproducer, a BPF program attached to sched_switch triggers bpf_ringbuf_commit(), queuing an irq_work. If the ring buffer is freed before this work executes, the irq_work thread may accesses freed memory. Calling `irq_work_sync(&rb->work)` ensures that all pending irq_work complete before freeing the buffer.

oracle-oval
23 дня назад

ELSA-2026-50006: Unbreakable Enterprise kernel security update (IMPORTANT)

EPSS

Процентиль: 19%
0.00061
Низкий

Дефекты