Skip to main content

Linux Kernel CVE-2025-68730

HIGH
2025-12-24 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux Red Hat Suse
7.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
5.8 MEDIUM

Local device access needed (AV:L/PR:L); trigger depends on an allocation-failure race, so AC:H; observed impact is a kernel crash (A:H) with limited, unproven memory-disclosure/corruption (C:L/I:L).

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Jul 30, 2026 - 07:03 vuln.today
CVE Published
Dec 24, 2025 - 11:16 cve.org
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

accel/ivpu: Fix page fault in ivpu_bo_unbind_all_bos_from_context()

Don't add BO to the vdev->bo_list in ivpu_gem_create_object(). When failure happens inside drm_gem_shmem_create(), the BO is not fully created and ivpu_gem_bo_free() callback will not be called causing a deleted BO to be left on the list.

AnalysisAI

Local privilege-tier memory corruption in the Linux kernel's Intel VPU/NPU accelerator driver (accel/ivpu) arises from a dangling buffer object left on a per-device list after a failed allocation, later dereferenced in ivpu_bo_unbind_all_bos_from_context() to cause a page fault. A local user with access to the ivpu device can trigger this use-after-free via the DRM/accel interface, with CVSS 7.8 (High) and CISA-style impact of confidentiality, integrity, and availability all High. There is no public exploit identified at time of analysis and the flaw is not in CISA KEV; the primary observed effect is a kernel page fault (crash), though the dangling-pointer condition carries corruption potential.

Technical ContextAI

The affected component is the accel/ivpu driver, the mainline Linux kernel driver for Intel's on-die NPU/VPU AI accelerators (present on recent Intel client SoCs such as Meteor Lake and later). The bug lives in ivpu_gem_create_object(), which prematurely added a buffer object (BO) to vdev->bo_list before the object was fully constructed. When drm_gem_shmem_create() fails partway through, the BO is never fully created, so the ivpu_gem_bo_free() cleanup callback never runs and a partially-freed/deleted BO remains linked on the list. A subsequent walk of that list in ivpu_bo_unbind_all_bos_from_context() dereferences the stale entry, producing a page fault. Although the input lists CWE as N/A, the root-cause class is a use-after-free / dangling pointer on an error path (CWE-416), tagged by the reporter as Information Disclosure.

Affected ProductsAI

The vulnerability affects the Linux kernel's accel/ivpu driver for Intel VPU/NPU accelerators. No CPE strings or explicit kernel version ranges were provided in the input; affected versions are those mainline and stable kernels containing the pre-fix ivpu_gem_create_object() behavior on systems with Intel NPU hardware and the ivpu driver loaded. The fix is tracked across three kernel.org stable commits: https://git.kernel.org/stable/c/8172838a284c27190fa6782c2740a97020434750, https://git.kernel.org/stable/c/8b694b405a84696f1d964f6da7cf9721e68c4714, and https://git.kernel.org/stable/c/c9ef5ccd8bd9bcf598b6d3f77e7eb4dde7149aec. Exact vulnerable-to-fixed version boundaries should be confirmed against each stable tree's changelog.

RemediationAI

Upstream fix available (commit); released patched version not independently confirmed - apply the kernel update that includes the three referenced stable commits (8172838a284c, 8b694b405a84, c9ef5ccd8bd9) by upgrading to the corresponding stable kernel release from your distribution, and rebooting into the patched kernel. As a compensating control where patching is deferred, prevent loading or access to the affected driver: blacklist the intel_vpu/ivpu module (e.g. add it to modprobe blacklist and rebuild initramfs) on hosts that do not use the Intel NPU, or restrict permissions on the /dev/accel/accel* device nodes so only trusted users/groups can issue ioctls to the accelerator. The trade-off is loss of NPU/AI-acceleration functionality for workloads that rely on the ivpu device; systems without Intel NPU hardware are unaffected in practice.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected

Share

CVE-2025-68730 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy