CVE-2025-68730

What it actually does

A use-after-free occurs when a buffer object is added to vdev->bo_list in ivpu_gem_create_object but a subsequent failure in drm_gem_shmem_create prevents ivpu_gem_bo_free from being invoked, leaving a deleted BO on the list that is later dereferenced in ivpu_bo_unbind_all_bos_from_context.

Why it matters to the business

Linux systems using the ivpu driver may experience kernel crashes or potential local privilege escalation, impacting stability of AI accelerator workloads with low urgency given absence of known exploitation or ransomware use.

How an attack unfolds

An attacker with local access crafts conditions to induce a drm_gem_shmem_create failure during BO creation, leaving a dangling reference; subsequent unbind operations then trigger invalid memory access that can be leveraged for code execution or denial of service.

How to fix it

Apply the kernel fix from commit 8172838a284c27190fa6782c2740a97020434750 or upgrade affected packages to beats-fips-8 8.17.3-r5, metricbeat-fips-8 8.17.3-r5, filebeat-fips-8 8.17.3-r5, auditbeat-fips-8 8.17.3-r5, or heartbeat-fips-8 8.17.3-r5.

How to confirm the fix worked

Confirm the source change that prevents adding BOs to vdev->bo_list prior to successful drm_gem_shmem_create completion, and verify no dangling references remain after creation failures.

Typical attack path

1. Trigger ivpu_gem_create_object under failure conditions in drm_gem_shmem_create
2. Allow incomplete BO initialization to bypass ivpu_gem_bo_free cleanup
3. Invoke ivpu_bo_unbind_all_bos_from_context to dereference the stale list entry
4. Exploit resulting page fault or UAF for kernel-level access

How to detect it

Inspect kernel logs and panic traces for references to ivpu_bo_unbind_all_bos_from_context or page faults involving buffer objects on vdev lists; correlate with failed GEM creation attempts.

What your security team should do

• Apply kernel and package updates to the listed fixed versions immediately on systems exposing ivpu
• Review stable Linux git repositories for backports to distribution kernels
• Monitor kernel logs for ivpu-related page faults until patches are deployed