CVE-2025-39896: 
Linux Kernel vulnerability analysis and mitigation

A vulnerability in the Linux kernel's Intel Visual Processing Unit (IVPU) driver was discovered and resolved on October 1, 2025. The issue affects the device removal process in the accel/ivpu subsystem, where recovery work could be queued even after device removal had started (NVD).

The vulnerability stems from using cancelworksync() instead of disableworksync() in the ivpudevfini() function. This implementation flaw allowed recovery work items to be queued after device removal had begun, potentially leading to use-after-free bugs when recovery processes attempted to access already freed resources. The fix involved replacing cancelworksync() with disableworksync() and renaming ivpupmcancelrecovery() to ivpupmdisablerecovery() to better reflect its functionality (NVD).

The vulnerability could result in use-after-free bugs when recovery processes attempt to access freed resources, potentially leading to system instability or crashes (NVD).

The vulnerability has been patched by implementing disableworksync() instead of cancelworksync() in ivpudevfini(). Users should update their Linux kernel to a version containing this fix (NVD).