Linux Kernel CVE-2025-68730

Requires local access to a system that has Intel NPU/VPU hardware with the accel/ivpu kernel driver loaded, plus the ability to open and issue buffer-object creation requests to the ivpu DRM/accel device node (PR:L per CVSS). The specific trigger is a failure inside drm_gem_shmem_create() during ivpu_gem_create_object() - i.e., an allocation failure must occur mid-creation so the incompletely-built BO is left on vdev->bo_list; this is the concrete precondition, not a default happy-path outcome. Limiting factors: exploitation is local only (AV:L), no network vector exists, systems without Intel NPU hardware or without the ivpu driver are not exploitable, and dependence on an allocation-failure race makes reliable triggering harder than the AC:L rating implies.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.8) frames this as a local, low-complexity, low-privilege flaw with high impact across all three dimensions. Real-world risk is materially lower than a network-facing 7.8: exploitation requires local code execution and access to the ivpu accelerator device node, and the trigger depends on an allocation failure inside BO creation, which is not attacker-reliable without inducing memory pressure - so effective attack complexity is higher than the vector's AC:L suggests. No EPSS score, no KEV listing, and no POC were provided, and the described symptom is a kernel page fault (denial of service) rather than a demonstrated info leak or code execution, so the C:H/I:H/A:H rating reflects worst-case UAF potential rather than a proven exploit. The 'Information Disclosure' tag is not substantiated by the description, which only shows a crash - treat the confidentiality claim as unverified. Net: a legitimate hygiene/DoS-class kernel fix relevant only to systems with the Intel NPU driver active, not an urgent internet-facing priority.

A local unprivileged or low-privileged user with access to the Intel NPU device node repeatedly issues BO-creation requests to the accel/ivpu driver while inducing memory pressure so that drm_gem_shmem_create() fails mid-construction. This leaves a deleted buffer object on vdev->bo_list, and when the context is torn down, ivpu_bo_unbind_all_bos_from_context() dereferences the stale entry and faults the kernel, crashing the system (DoS). No public POC was provided, and reliable exploitation depends on winning the allocation-failure condition.