UBUNTU-CVE-2025-68730: High severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Fix page fault in ivpubounbindallbosfromcontext() Don't add BO to the vdev->bolist in ivpugemcreateobject(). When failure happens inside drmgemshmemcreate(), the BO is not fully created and ivpugembofree() callback will not be called causing a deleted BO to be left on the list.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-aws-6.17to a version that resolves this vulnerability.Fixed in 6.17.0-1009.9~24.04.2 - Upgrade
Upgrade
ubuntu/linux-azure-6.17to a version that resolves this vulnerability.Fixed in 6.17.0-1010.10~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-6.17to a version that resolves this vulnerability.Fixed in 6.17.0-1009.9~24.04.3 - Upgrade
Upgrade
ubuntu/linux-hwe-6.17to a version that resolves this vulnerability.Fixed in 6.17.0-19.19~24.04.2 - Upgrade
Upgrade
ubuntu/linux-nvidia-6.17to a version that resolves this vulnerability.Fixed in 6.17.0-1018.18 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegrato a version that resolves this vulnerability.Fixed in 6.8.0-1038.42 - Upgrade
Upgrade
ubuntu/linux-oem-6.17to a version that resolves this vulnerability.Fixed in 6.17.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracle-6.17to a version that resolves this vulnerability.Fixed in 6.17.0-1009.9~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-6.17to a version that resolves this vulnerability.Fixed in 6.17.0-19.19.1~24.04.1 - Upgrade
Upgrade
ubuntu/linux-realtime-6.17to a version that resolves this vulnerability.Fixed in 6.17.0-1008.9~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 6.17.0-19.19 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 6.17.0-1009.9 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 6.17.0-1010.10 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 6.17.0-1009.9 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 6.17.0-1009.9 - Upgrade
Upgrade
ubuntu/linux-raspito a version that resolves this vulnerability.Fixed in 6.17.0-1010.10 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 6.17.0-1008.9 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 6.17.0-19.19.1 - Compensating control
In ivpu_gem_create_object(), do not add the BO to vdev->bo_list; this prevents a partially created BO from remaining on the list when drm_gem_shmem_create() fails.
Event History
Frequently Asked Questions
What level of access would an attacker need?
The CVSS vector indicates that exploitation requires local access and low privileges. The attack complexity is rated high, and no user interaction is required.
Which Ubuntu kernel package families are listed as affected?
The affected software list includes ubuntu/linux-riscv, ubuntu/linux-realtime, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-azure-fde, ubuntu/linux-hwe-edge, ubuntu/linux-gke, and ubuntu/linux-gkeop.
What is the potential security impact if exploitation succeeds?
The vulnerability is rated high severity with high impacts to confidentiality, integrity, and availability of the vulnerable component. The provided vector does not indicate impact on a separate subsequent system.