Use-after-free in Linux kernel BPF ring buffer IRQ work cleanup

CVE-2025-40319 is a Linux kernel vulnerability in the BPF ring buffer subsystem caused by a race between queued irq_work and ring buffer teardown. The vulnerable condition occurs when bpf_ringbuf_commit() queues irq_work associated with a ring buffer, but the ring buffer is freed before that deferred work executes. In the reported syzbot reproducer, a BPF program attached to sched_switch triggers bpf_ringbuf_commit(), which queues rb->work; if teardown proceeds first, the irq_work handler can subsequently access memory belonging to the already-freed ring buffer. This results in a kernel use-after-free condition. The upstream fix synchronizes pending deferred work during cleanup by calling irq_work_sync(&rb->work) before freeing the ring buffer, ensuring all queued irq_work has completed.