Executive brief
The Linux kernel's ring-buffer tracing component could be destroyed while pending interrupt work was still scheduled to access it, causing a use-after-free memory error. An attacker could potentially exploit this to crash the kernel or execute arbitrary code, though this typically requires specific timing conditions or specialized system configurations.
Technical details
The vulnerability is a use-after-free condition in the Linux kernel's ring-buffer implementation. When data is written to the buffer just before destruction, IRQ work is scheduled to process it, but the ring-buffer may be freed before the IRQ work handler executes, causing the handler to access freed memory. This occurs because prior kernel changes introduced per-CPU IRQ work structures, creating a race condition between buffer destruction and work completion. The attack vector requires the ability to trigger ring-buffer operations and destruction in close succession. A fix involves adding irq_work_sync() calls to ensure pending interrupt work completes before the buffer is destroyed.
Affected products
- Linux Linux Kernel 6.3.0-rc1 and potentially other versions with per-CPU ring-buffer IRQ work
Timeline
- 2025-10-04: disclosed