Executive brief
A race condition was identified in the Linux kernel's Intel VPU (Versatile Processing Unit) driver, which is used for AI acceleration tasks. This flaw could allow a local user to cause a system crash or potentially gain unauthorized access to memory by exploiting how the system manages memory buffers during cleanup. The issue primarily impacts system stability and the integrity of data handled by the VPU.
Technical details
A race condition exists in the accel/ivpu driver within the Linux kernel when unbinding Buffer Objects (BOs). The vulnerability occurs because ivpu_gem_bo_free() removes a BO from the internal list before it is fully unmapped, leading to a 'Memory manager not clean during takedown' warning and potential use-after-free or double-free scenarios during context teardown in drm_mm_takedown(). An attacker with local access could exploit this improper synchronization (CWE-362) to cause a denial of service or escalate privileges. The fix involves extending the scope of the bo_list_lock to protect the entire unmapping sequence, ensuring BOs are either fully unmapped or remain visible on the list during teardown. Patches have been released for multiple stable kernel branches including 6.12.68, 6.17.13, and 6.18.2.
Affected products
- Linux Linux Kernel 6.8 to 6.12.67, 6.13 to 6.17.12, 6.18 to 6.18.1
Timeline
- 2025-12-24: disclosed
- 2025-12-24: advisory
- 2025-10-30: patched