Service interruption via ivpu buffer teardown race

Race condition in the ivpu GEM teardown path in affected Linux 6.x kernels allows local users to cause a service interrupt during context teardown. ivpu_gem_bo_free() removes a buffer object from the file's BO list before unmapping it, so file_priv_unbind() reaches drm_mm_takedown() with stale mappings during concurrent teardown. Reachability requires local low-privilege access and use of the Intel VPU buffer-object path; the published impact is service interruption without reported data disclosure or modification.