CVE-2025-68749: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68749 is a race condition vulnerability in the Linux kernel's Intel VPU (accel/ivpu) graphics driver that can lead to a kernel warning and system instability during context teardown. The flaw occurs when ivpu_gem_bo_free() removes a buffer object (BO) from the BOs list before it is properly unmapped, triggering a 'Memory manager not clean during takedown' warning in drm_mm_takedown(). It affects Linux kernel versions 6.8 through 6.12.67, 6.13 through 6.17.12, and 6.18 through 6.18.1. Published on December 24, 2025, it carries a CVSS v3.1 base score of 4.7 (Medium) (Feedly).

The root cause is improper synchronization (CWE-362: Race Condition) in the Intel VPU kernel driver's buffer object lifecycle management. Specifically, ivpu_gem_bo_free() can remove a BO from the tracked list before the unmapping sequence completes; if file_priv_unbind() then runs during context teardown, it encounters an inconsistent memory manager state and triggers a warning in drm_mm_takedown(). The fix protects the unmapping sequence with bo_list_lock, ensuring a BO is either fully unmapped at context teardown time or still present on the list to be unmapped by file_priv_unbind(). Exploitation requires local access with low privileges and precise timing (high attack complexity). No public proof-of-concept exploit is known (Feedly, Kernel Patch).

Successful exploitation can cause a kernel warning and resource management failure in the Intel VPU driver, potentially resulting in denial of service through system instability or driver malfunction. There is no confidentiality or integrity impact; the availability impact is rated High due to the potential for kernel-level disruption during context teardown. The scope is limited to the local system and does not enable lateral movement or data exfiltration (Feedly).

Upgrade the Linux kernel to one of the following patched versions: 6.12.68 or later (for the 6.8–6.12 series), 6.17.13 or later (for the 6.13–6.17 series), or 6.18.2 or later (for the 6.18+ series). Patch commits are available at the upstream stable kernel repository. Ubuntu security notices USN-8278-1, USN-8289-1, USN-8296-1, and USN-8393-1 address this issue for affected Ubuntu releases. No configuration-based workaround is available; patching is the only remediation (Feedly, Ubuntu USN-8278-1, Kernel Patch).