bpf: Sync pending IRQ work before freeing ring buffer

Summary

In the Linux kernel, the following vulnerability has been resolved: bpf: Sync pending IRQ work before freeing ring buffer Fix a race where irq_work can be queued in bpf_ringbuf_commit() but the ring buffer is freed before the work executes. In the syzbot reproducer, a BPF program attached to sched_switch triggers bpf_ringbuf_commit(), queuing an irq_work. If the ring buffer is freed before this work executes, the irq_work thread may accesses freed memory. Calling `irq_work_sync(&rb->work)` ensures that all pending irq_work complete before freeing the buffer.

Timeline

1. Dec 8, 2025, 12:46 AM UTCCVE published
2. Oct 15, 2026, 9:59 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: total

3. Oct 15, 2026, 10:02 PM UTCRecord last updated

Affected versions

• Linux Linux

  From 457f44363a8894135c85b7a9afd2bd8196db24ab · fixed in 47626748a2a00068dbbd5836d19076637b4e235b; From 457f44363a8894135c85b7a9afd2bd8196db24ab · fixed in de2ce6b14bc3e565708a39bdba3ef9162aeffc72; From 457f44363a8894135c85b7a9afd2bd8196db24ab · fixed in e1828c7a8d8135e21ff6adaaa9458c32aae13b11; From 457f44363a8894135c85b7a9afd2bd8196db24ab · fixed in 6451141103547f4efd774e912418a3b4318046c6; From 457f44363a8894135c85b7a9afd2bd8196db24ab · fixed in 10ca3b2eec384628bc9f5d8190aed9427ad2dde6; From 457f44363a8894135c85b7a9afd2bd8196db24ab · fixed in 430e15544f11f8de26b2b5109c7152f71b78295e; From 457f44363a8894135c85b7a9afd2bd8196db24ab · fixed in 4e9077638301816a7d73fa1e1b4c1db4a7e3b59c

• Linux Linux

  5.8

• KernelLinux

  From 5.8.0 · fixed in 5.10.247; From 5.11.0 · fixed in 5.15.197; From 5.16.0 · fixed in 6.1.159; From 6.2.0 · fixed in 6.6.117; From 6.7.0 · fixed in 6.12.58; From 6.13.0 · fixed in 6.17.8

References 7