CVE-2025-68749: accel/ivpu: Fix race condition when unbinding BOs
In the Linux kernel, the following vulnerability has been resolved:
accel/ivpu: Fix race condition when unbinding BOs
Fix 'Memory manager not clean during takedown' warning that occurs when ivpugembofree() removes the BO from the BOs list before it gets unmapped. Then fileprivunbind() triggers a warning in drmmmtakedown() during context teardown.
Protect the unmapping sequence with bolistlock to ensure the BO is always fully unmapped when removed from the list. This ensures the BO is either fully unmapped at context teardown time or present on the list and unmapped by fileprivunbind().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernel (accel/ivpu)to a version that resolves this vulnerability.Patch accel/ivpu: Fix race condition when unbinding BOs
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using the Linux kernel's accel/ivpu driver and exercising IVPU GEM buffer-object lifecycle operations are exposed. The race occurs during buffer-object unbinding and context teardown.
What access does an attacker need?
The supplied vector indicates local access, low attack complexity, low privileges, and no user interaction. Exploitation therefore requires a locally authenticated actor able to interact with the affected kernel functionality.
What is the impact if the race is triggered?
The issue can leave memory-manager state unclean during teardown because a buffer object may be removed from the tracking list before it is fully unmapped. The provided severity vector rates confidentiality, integrity, and availability impacts as high.
What does the fix change?
The fix protects the buffer-object unmapping sequence with bo_list_lock. This ensures a buffer object is fully unmapped before removal from the list, or remains listed so file_priv_unbind() can unmap it during teardown.