Security readout for executives and security teams
Plain-English summary
A Linux Intel VPU driver bookkeeping flaw can leave a deleted, partially created buffer object on an internal list. Later cleanup may access that stale object and trigger a kernel page fault. The supplied CVSS rates potential confidentiality, integrity, and availability impact as high, but exploitation requires local low-privileged access.
Executive priority
Prioritize affected multi-user or untrusted-workload systems because local low-privileged access may lead to serious impact. Patch through supported Linux distribution channels. Internet exposure alone does not establish reachability because the supplied vector is local. Treat version-only scanning cautiously until vendor package mappings are confirmed.
Technical view
If drm_gem_shmem_create() fails, the buffer object is not fully initialized and ivpu_gem_bo_free() is not called. Because ivpu_gem_create_object() added it to vdev->bo_list, a stale entry remains. ivpu_bo_unbind_all_bos_from_context() may later traverse that entry and page fault. The fix avoids adding the object at that stage.
Likely exposure
Exposure is limited to Linux systems using the affected accel/ivpu driver code. The bundle identifies Linux 6.8, 6.17.13, 6.18.2, and 6.19 as affected, but its version representation is ambiguous. Confirm exposure against distribution advisories and backported fixes rather than relying only on version strings.
Exploitation context
The CVSS vector indicates a local, low-complexity attack requiring low privileges and no user interaction. The bundle does not identify public exploitation, and the CVE is not listed as KEV. The supplied evidence describes a kernel page fault condition but provides no demonstrated attack chain or observed real-world exploitation.
Researcher notes
The root issue is stale-list membership following failed GEM shared-memory object creation. Available evidence establishes the faulty lifecycle and corrective direction, but not the exact trigger conditions, exploitability beyond a page fault, or whether every CVSS impact is practically achievable. The affected-version data contains duplicate commit identifiers and unclear boundaries.
Mitigation direction
- Install a vendor-supported kernel containing the applicable referenced fix or backport.
- Check distribution security guidance before interpreting upstream kernel version numbers.
- Restrict untrusted local access where immediate kernel remediation is unavailable.
- Disable unused VPU functionality only if supported and operationally acceptable.
Validation and detection
- Inventory kernel builds and identify systems loading or packaging the accel/ivpu driver.
- Confirm whether affected systems contain one of the referenced corrective commits or vendor backports.
- Review vendor advisories for precise affected and fixed package versions.
- After updating, verify the intended kernel is running and monitor for related page faults.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-68730 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/8172838a284c27190fa6782c2740a97020434750CVE reference, Linux
- https://git.kernel.org/stable/c/c9ef5ccd8bd9bcf598b6d3f77e7eb4dde7149aecCVE reference, Linux
- https://git.kernel.org/stable/c/8b694b405a84696f1d964f6da7cf9721e68c4714CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.