CVE-2025-68730: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68730 is a page fault vulnerability in the Linux kernel's accel/ivpu (Intel Vision Processing Unit) driver, specifically in the ivpu_bo_unbind_all_bos_from_context() function. The flaw was disclosed on December 24, 2025, and affects Linux kernel versions starting from commit 8d88e4cdce4f5c56de55174a4d32ea9c06f7fa66 up to the patched releases. Affected kernel versions include those prior to 6.17.13, 6.18.2, and 6.19-rc1. It carries a CVSS v3.1 base score of 7.0 (High) (Red Hat CVE, Red Hat Bugzilla).

The root cause is improper lifecycle management of Buffer Objects (BOs) in the ivpu_gem_create_object() function (CWE-416: Use After Free / dangling pointer). When drm_gem_shmem_create() fails internally, the partially initialized BO is added to vdev->bo_list before the failure is detected, but the ivpu_gem_bo_free() cleanup callback is never invoked. This leaves a dangling, deleted BO on the list, which is later dereferenced during ivpu_bo_unbind_all_bos_from_context(), triggering a kernel page fault. Exploitation requires local access with low privileges and high attack complexity, as the attacker must be able to trigger the specific failure path in the IVPU driver (Red Hat Bugzilla, Red Hat CVE).

Successful exploitation could result in high confidentiality, integrity, and availability impacts on the affected system, as indicated by the CVSS scoring. The kernel page fault triggered by the dangling BO pointer may cause system instability or crashes (denial of service), and in more severe scenarios could potentially be leveraged for privilege escalation or memory disclosure on systems with Intel VPU hardware. The vulnerability is scoped to the local system and does not directly enable lateral movement across a network (Red Hat CVE).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.017%, reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access with low privileges and high attack complexity, further limiting practical risk (Red Hat CVE).

The fix has been applied to Linux kernel versions 6.17.13, 6.18.2, and 6.19-rc1. The patch modifies ivpu_gem_create_object() to defer adding the BO to vdev->bo_list until after successful creation, preventing the dangling pointer condition. Users should update to a patched kernel version as the primary remediation. As a secondary measure, monitoring system logs for kernel page fault messages related to the accel/ivpu driver can help detect anomalous behavior on systems with Intel VPU hardware (Red Hat Bugzilla, Red Hat CVE).