CVE-2025-68749

What it actually does

Race condition in ivpu_gem_bo_free during BO unbinding allows removal from BO list before unmapping completes, triggering drm_mm_takedown warning on context teardown.

Why it matters to the business

Systems using the affected Linux kernel on Debian 13 may experience memory manager warnings or instability during accelerator context teardown, potentially leading to operational disruptions in environments relying on Intel VPU hardware; low exploitability and no known active campaigns reduce urgency but patching remains necessary for stability.

How an attack unfolds

An attacker with local access triggers concurrent unbinding operations on buffer objects in the ivpu driver to exploit the unprotected removal from the list before unmapping, resulting in incomplete cleanup visible only at teardown.

How to fix it

Upgrade the linux package on Debian 13 to version 6.12.20-1 or later which includes the bo_list_lock protection around the unmapping sequence.

How to confirm the fix worked

Confirm kernel version is at least 6.12.20-1, then exercise ivpu context creation and teardown paths while monitoring for absence of 'Memory manager not clean during takedown' warnings in dmesg.

Typical attack path

1. Obtain local user access on affected system
2. Load or interact with ivpu accelerator driver
3. Trigger concurrent BO allocation and unbind sequences
4. Force context teardown to surface the memory manager warning

How to detect it

Search kernel logs for 'Memory manager not clean during takedown' or ivpu_gem_bo_free related entries around context teardown events; no widespread exploitation indicators expected given low EPSS and no KEV listing.

What your security team should do

• Prioritize upgrade of linux package to 6.12.20-1 on all Debian 13 systems using ivpu
• Monitor dmesg for memory manager warnings on accelerator teardown as a stability indicator
• Review accelerator usage in production workloads for potential impact before applying update