CVE-2025-68730

A use-after-free vulnerability was found in the Intel VPU (Vision Processing Unit) accelerator driver in the Linux kernel. When buffer object creation fails inside drm_gem_shmem_create(), the partially created buffer object is added to vdev->bo_list but the cleanup callback ivpu_gem_bo_free() is never called. This leaves a dangling pointer on the list, causing a page fault when ivpu_bo_unbind_all_bos_from_context() later traverses the list.

This vulnerability affects systems with Intel VPU accelerator hardware. The issue occurs during error handling of buffer object creation, requiring specific failure conditions to trigger. Exploitation leads to a kernel crash but does not allow arbitrary code execution as the dangling pointer cannot be controlled by an attacker.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.