Linux Kernel CVE-2025-68749

Apply the upstream kernel patches available at the four stable kernel git commits listed in the references. Distribution maintainers (Red Hat, Ubuntu, SUSE, Debian, etc.) are expected to backport these fixes into their stable kernel packages; check your distribution's security advisories for the specific package version that includes the fix. Until a patched kernel is deployed, a targeted workaround is to unload or blacklist the ivpu kernel module ('modprobe -r intel_vpu' or adding 'blacklist intel_vpu' to /etc/modprobe.d/) on systems where VPU/NPU acceleration is not required - this eliminates the attack surface at the cost of losing Intel NPU functionality for AI/ML inference workloads. Restricting unprivileged access to /dev/accel devices via udev rules or group permissions also reduces exposure by preventing low-privilege users from interacting with the driver, though it does not eliminate the vulnerability.