CVE-2025-40319

In the Linux kernel, the following vulnerability has been resolved:

bpf: Sync pending IRQ work before freeing ring buffer

Fix a race where irq_work can be queued in bpf_ringbuf_commit()

but the ring buffer is freed before the work executes.

In the syzbot reproducer, a BPF program attached to sched_switch

triggers bpf_ringbuf_commit(), queuing an irq_work. If the ring buffer

is freed before this work executes, the irq_work thread may accesses

freed memory.

Calling `irq_work_sync(&rb->work)` ensures that all pending irq_work

complete before freeing the buffer.