CVE-2024-54193: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-54193 affects the Linux kernel's Intel VPU (Visual Processing Unit) driver, specifically in the accel/ivpu component. The vulnerability was discovered and disclosed on January 11, 2025, relating to a runtime state management issue in the ivpuipcsendreceiveinternal() function (NVD).

The vulnerability stems from incorrect runtime state management in the Intel VPU driver. Specifically, the issue occurs when ivpuipcsendreceiveinternal() is executed before ivpupmenable(), causing a WARN condition due to improper runtime state handling. The fix involves moving the pmruntimesetactive() call to ivpupm_init() to ensure correct runtime state initialization, even if the last resume was not successful (Kernel Commit).

The vulnerability affects systems running the Linux kernel with Intel VPU hardware. Ubuntu has marked this as medium priority, with newer versions (24.04 LTS noble and 24.10 oracular) being vulnerable, while older versions (22.04 LTS and earlier) are not affected (Ubuntu Security).

A fix has been implemented in the Linux kernel through a patch that moves the pmruntimeset_active() call to the initialization phase. The patch has been reviewed and approved by kernel maintainers Karol Wachowski and Jeffrey Hugo, and is included in kernel version 6.7 and later (Kernel Commit).