CVE-2025-40319

What it actually does

Race condition in BPF ring buffer handling allows irq_work queued by bpf_ringbuf_commit() to execute after the ring buffer is freed, resulting in use-after-free access to kernel memory.

Why it matters to the business

Local attackers on affected Linux systems can trigger kernel crashes, denial of service, or potential privilege escalation; high ecosystem prevalence increases exposure for servers, containers, and embedded devices until kernels are updated.

How an attack unfolds

An attacker with local access loads a BPF program attached to sched_switch that calls bpf_ringbuf_commit() to queue irq_work, then frees the ring buffer before the work executes, causing the irq_work thread to dereference freed memory.

How to fix it

Update the Linux kernel to a version containing commit 47626748a2a00068dbbd5836d19076637b4e235b or later; rebuild and reboot with the patched kernel; disable untrusted BPF program loading via sysctl where feasible until patched.

How to confirm the fix worked

Verify kernel source or package version includes commit 47626748a2a00068dbbd5836d19076637b4e235b; confirm irq_work_sync is called before ring buffer free in bpf_ringbuf_free; test with reproducer workloads that previously triggered the race.

Typical attack path

1. Obtain local unprivileged access on a vulnerable Linux system
2. Load a malicious or crafted BPF program that triggers bpf_ringbuf_commit() on sched_switch
3. Race the ring buffer free operation against pending irq_work execution
4. Trigger use-after-free to crash the kernel or attempt memory corruption for escalation

How to detect it

Search kernel logs for oops, warnings, or use-after-free reports referencing bpf_ringbuf, ring buffer, or irq_work; inspect audit logs for unexpected BPF program loads or attachments around crash times.

What your security team should do

• Prioritize kernel updates on all systems allowing unprivileged BPF loading within the next patch cycle
• Restrict BPF privileges using CAP_BPF and unprivileged_bpf_disabled sysctl until patches are deployed
• Monitor for kernel oops or crashes involving bpf_ringbuf or irq_work as potential exploitation signs
• Review and limit BPF program attachment points on production hosts