Executive brief
A race condition vulnerability was identified in the Linux kernel's BPF (Berkeley Packet Filter) subsystem, which is used for high-performance networking and system monitoring. The flaw occurs when the system attempts to free a data buffer while a background task is still trying to process information within it. An attacker with local access could exploit this to cause a system crash or potentially execute unauthorized actions by accessing memory that has already been released.
Technical details
A race condition exists in kernel/bpf/ringbuf.c where irq_work can be queued via bpf_ringbuf_commit() but the underlying ring buffer (rb) is freed before the work executes. This occurs because the bpf_ringbuf_free function lacked proper synchronization with pending interrupt requests. An attacker can trigger this by attaching a BPF program to a high-frequency event like sched_switch to queue irq_work and then immediately triggering a buffer free, leading to a use-after-free (UAF) when the irq_work thread accesses the released memory. The fix introduces a call to irq_work_sync(&rb->work) in the free path to ensure all pending tasks complete before memory reclamation.
Affected products
- Linux Linux Kernel 5.8 to 6.17.8
Timeline
- 2025-10-20: disclosed: Vulnerability reported by syzbot and patch submitted by Noorain Eqbal
- 2025-11-13: patched: Patch committed to stable trees by Greg Kroah-Hartman
- 2025-12-08: advisory: CVE-2025-40319 published
References
- https://git.kernel.org/stable/c/10ca3b2eec384628bc9f5d8190aed9427ad2dde6
- https://git.kernel.org/stable/c/430e15544f11f8de26b2b5109c7152f71b78295e
- https://git.kernel.org/stable/c/47626748a2a00068dbbd5836d19076637b4e235b
- https://git.kernel.org/stable/c/4e9077638301816a7d73fa1e1b4c1db4a7e3b59c
- https://git.kernel.org/stable/c/6451141103547f4efd774e912418a3b4318046c6
- https://git.kernel.org/stable/c/de2ce6b14bc3e565708a39bdba3ef9162aeffc72
- https://git.kernel.org/stable/c/e1828c7a8d8135e21ff6adaaa9458c32aae13b11