CVE-2025-39896

What it actually does

Race condition in the Intel VPU accelerator driver allows recovery work items to be queued after device removal has begun, enabling use-after-free or invalid memory access in kernel context.

Why it matters to the business

Systems using affected SUSE packages or upstream Linux kernels may experience crashes, instability, or local privilege escalation on devices with Intel VPU hardware; low exploitability but requires prompt patching of production kernels and development environments.

How an attack unfolds

An attacker with local access on a system with an Intel VPU device triggers concurrent device removal and recovery scheduling paths to hit the window where work is queued against a freed structure; no named threat actors or ransomware campaigns are associated with this issue.

How to fix it

Update to fixed versions: gcc43 and libffi43 packages to 4.3.4_20091019-24.8.1 on SUSE Studio Onsite 1.3 and Runner 1.3; apply upstream kernel commit 54c49eca38dbd06913a696f6d7610937dcfad226 or later stable releases containing the ivpu driver change.

How to confirm the fix worked

Verify package versions match the listed fixed releases; confirm kernel source contains commit 54c49eca38dbd06913a696f6d7610937dcfad226; test device removal and recovery paths under load to ensure no work is queued post-removal.

Typical attack path

1. Obtain local user access on target Linux system
2. Identify or trigger conditions for Intel VPU device removal
3. Race recovery work queuing against removal cleanup
4. Trigger use-after-free or kernel panic for denial of service or potential escalation

How to detect it

Review kernel logs for ivpu driver warnings or oops during device removal events; inspect for unexpected workqueue activity involving ivpu recovery functions around removal timestamps.

What your security team should do

• Prioritize kernel and package updates on all systems with Intel VPU hardware
• Monitor EPSS and KEV status for any future increase in exploit activity
• Apply updates within standard change windows given low current EPSS