Skip to main content

Linux Kernel CVE-2025-40319

| EUVDEUVD-2025-201626 HIGH
2025-12-08 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux Red Hat Suse
7.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

Local BPF-load privilege needed (PR:L, AV:L); exploiting an irq_work-vs-free timing race is non-deterministic, so AC:H; kernel UAF yields full C/I/A impact.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.7 MEDIUM
qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

6
CVSS changed
Jul 30, 2026 - 06:37 NVD
7.8 (HIGH)
Patch released
Mar 16, 2026 - 15:00 nvd
Patch available
EUVD ID Assigned
Mar 15, 2026 - 17:54 euvd
EUVD-2025-201626
Analysis Generated
Mar 15, 2026 - 17:54 vuln.today
CVE Published
Dec 08, 2025 - 01:16 cve.org
HIGH 7.8
CVE Published
Dec 08, 2025 - 01:16 nvd
N/A

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

bpf: Sync pending IRQ work before freeing ring buffer

Fix a race where irq_work can be queued in bpf_ringbuf_commit() but the ring buffer is freed before the work executes. In the syzbot reproducer, a BPF program attached to sched_switch triggers bpf_ringbuf_commit(), queuing an irq_work. If the ring buffer is freed before this work executes, the irq_work thread may accesses freed memory. Calling irq_work_sync(&rb->work) ensures that all pending irq_work complete before freeing the buffer.

AnalysisAI

Local privilege escalation and kernel memory corruption in the Linux kernel's BPF ring buffer subsystem allows a low-privileged user capable of loading BPF programs to trigger a use-after-free. A race exists where irq_work queued in bpf_ringbuf_commit() can execute after the ring buffer is freed, letting the irq_work handler access freed memory - a bug found by syzbot via a BPF program attached to sched_switch. The fix adds irq_work_sync(&rb->work) before freeing the buffer. There is no public exploit identified at time of analysis, and EPSS is very low (0.05%), but kernel UAF flaws are historically weaponizable for local privilege escalation.

Technical ContextAI

The affected component is the eBPF ring buffer (BPF_MAP_TYPE_RINGBUF), a shared memory data structure used by BPF programs to stream events to user space. When a BPF program calls bpf_ringbuf_commit(), the kernel may schedule deferred processing via irq_work (a mechanism to run work in hard-IRQ context). The root cause is a lifetime/synchronization defect: the ring buffer (rb) can be freed while an irq_work item referencing rb->work is still pending, so the handler dereferences released memory. This is a classic use-after-free (CWE-416), specifically a race between object teardown and deferred asynchronous work (related to CWE-362 race condition). Because the trigger path runs on a scheduler tracepoint (sched_switch), the window is realistically hit under normal scheduling churn. CWE was listed as N/A in the source data; the UAF classification is inferred from the description.

RemediationAI

Vendor-released patch: upgrade to a fixed Linux kernel - 5.10.247, 5.15.197, 6.1.159, 6.6.117, 6.12.58, 6.17.8, or 6.18 or later, matching your kernel branch. Ubuntu users should apply the updates in https://ubuntu.com/security/notices/USN-8096-1 and https://ubuntu.com/security/notices/USN-8095-1 and reboot into the new kernel (or use livepatch where offered). If immediate patching is not possible, the most effective compensating control is to prevent untrusted users from creating BPF ring buffers: ensure unprivileged BPF is disabled by setting sysctl kernel.unprivileged_bpf_disabled=1 (or =2), which blocks non-CAP_BPF/CAP_SYS_ADMIN users from loading BPF programs - the trade-off is that legitimate unprivileged BPF tooling (some observability/tracing utilities) will stop working. Where feasible, also restrict CAP_BPF/CAP_SYS_ADMIN and limit which workloads/containers may attach BPF programs to tracepoints such as sched_switch. Cross-reference the exact fixed package version for your distribution before deploying.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.0/baremetal-os-container:latest Affected
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.95 Image SL-Micro Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.115 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.146 Affected
Container suse/sl-micro/6.0/toolbox:latest Affected

Share

CVE-2025-40319 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy