Executive brief
A vulnerability in the Linux kernel's Intel VPU (Vision Processing Unit) driver could allow a local user to cause a system crash. The issue occurs when the system fails to properly clean up memory objects during a failed creation process, leading to a 'page fault' or system instability. This primarily impacts the availability of systems using specific Intel acceleration hardware.
Technical details
A race condition or improper error handling in the accel/ivpu driver leads to a page fault in ivpu_bo_unbind_all_bos_from_context(). The root cause is that Buffer Objects (BO) were being added to the device's bo_list in ivpu_gem_create_object() before they were fully initialized. If a failure occurred within drm_gem_shmem_create(), the ivpu_gem_bo_free() callback would not be triggered, leaving a pointer to a deleted BO on the list. A local attacker with access to the VPU device could potentially trigger this condition to cause a kernel oops or denial of service. The fix moves the list addition to later stages of the allocation and import processes (ivpu_bo_alloc and ivpu_gem_prime_import) where success is guaranteed.
Affected products
- Linux Linux Kernel 6.8 to 6.17.13, 6.18.2
Timeline
- 2025-09-25: disclosed: Initial patch authored
- 2025-12-24: advisory: CVE published by kernel.org