CVE-2025-68170 (GCVE-0-2025-68170)

Vulnerability from cvelistv5 – Published: 2025-12-16 13:42 – Updated: 2026-08-05 12:09
VLAI
Title
drm/radeon: Do not kfree() devres managed rdev
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/radeon: Do not kfree() devres managed rdev Since the allocation of the drivers main structure was changed to devm_drm_dev_alloc() rdev is managed by devres and we shouldn't be calling kfree() on it. This fixes things exploding if the driver probe fails and devres cleans up the rdev after we already free'd it. (cherry picked from commit 16c0681617b8a045773d4d87b6140002fa75b03b)
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: a9ed2f052c5c14e4be58c5ec8794dffc87588123 , < f7482516002a11317912e29577bbf33cf59a0fb1 (git)
Affected: a9ed2f052c5c14e4be58c5ec8794dffc87588123 , < 2413bbd1d692aed245c2aa38a369a1fa7590db84 (git)
Affected: a9ed2f052c5c14e4be58c5ec8794dffc87588123 , < 3328443363a0895fd9c096edfe8ecd372ca9145e (git)
Create a notification for this product.
Linux Linux Affected: 6.12
Unaffected: 0 , < 6.12 (semver)
Unaffected: 6.12.58 , ≤ 6.12.* (semver)
Unaffected: 6.17.8 , ≤ 6.17.* (semver)
Unaffected: 6.18 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/radeon/radeon_kms.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f7482516002a11317912e29577bbf33cf59a0fb1",
              "status": "affected",
              "version": "a9ed2f052c5c14e4be58c5ec8794dffc87588123",
              "versionType": "git"
            },
            {
              "lessThan": "2413bbd1d692aed245c2aa38a369a1fa7590db84",
              "status": "affected",
              "version": "a9ed2f052c5c14e4be58c5ec8794dffc87588123",
              "versionType": "git"
            },
            {
              "lessThan": "3328443363a0895fd9c096edfe8ecd372ca9145e",
              "status": "affected",
              "version": "a9ed2f052c5c14e4be58c5ec8794dffc87588123",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/radeon/radeon_kms.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.12"
            },
            {
              "lessThan": "6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.58",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.58",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.8",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/radeon: Do not kfree() devres managed rdev\n\nSince the allocation of the drivers main structure was changed to\ndevm_drm_dev_alloc() rdev is managed by devres and we shouldn\u0027t be calling\nkfree() on it.\n\nThis fixes things exploding if the driver probe fails and devres cleans up\nthe rdev after we already free\u0027d it.\n\n(cherry picked from commit 16c0681617b8a045773d4d87b6140002fa75b03b)"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is a PCI/DRM driver teardown path reached only from local system operations (driver probe failure, sysfs unbind, module unload, PCI hot-remove, VM shutdown), and the resulting freed-slab primitive is consumed locally via heap grooming and concurrent `/dev/dri/*` ioctls. No network or adjacent-network input reaches it.\nAC:L - This is a deterministic double free, not a race \u2014 once `radeon_driver_unload_kms()` runs, `kfree(rdev)` always precedes the devres/drm-managed release of the same allocation, and the subsequent UAF dereferences in `drm_dev_unregister()`/`drm_dev_release()` occur unconditionally. Slab reclaim of the freed container is groomable by the attacker with ordinary allocation pressure.\nPR:L - Consistent with how this CNA scores probe/remove-path devres-lifetime corruption, an unprivileged local user is the one who weaponizes it: the primary and render minors are still registered when `kfree(rdev)` runs, so a low-privileged process holding an open `/dev/dri/renderD128` (world-accessible on essentially all distros and on Android) can spray the freed container and drive ioctls against the freed `drm_device` while a routine removal event \u2014 eGPU/Thunderbolt unplug, PCI hot-remove, VM reboot, or boot-time probe failure \u2014 supplies the trigger.\nUI:N - No action by a separate victim user is needed; the boot-time probe-failure path and the in-VM `radeon_pci_shutdown()` \u2192 `radeon_pci_remove()` path fire as part of normal system operation, and the attacker\u0027s spray/exploit steps require no interaction.\nS:U - The corruption is confined to the kernel\u0027s own slab allocator and DRM device state, within the same security authority; no hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - After the free, `drm_minor_unregister()` and `drm_managed_release()` re-read `dev-\u003eprimary`, `dev-\u003erender`, `dev-\u003eaccel` and the `dev-\u003emanaged.resources` list out of the freed allocation, and open render-node fds still dereference the freed `drm_device`/`rdev`; an attacker who reclaims the slab gets a use-after-free read primitive usable for kernel memory disclosure.\nI:H - `drm_managed_release()` performs an indirect call through `dr-\u003enode.release()` read from freed memory, and `drm_dev_release()` then does `kfree(dev-\u003emanaged.final_kfree)` on a pointer read from freed memory \u2014 a control-flow hijack plus arbitrary/double-free primitive, compounded by the `kref_put()` write into freed memory.\nA:H - Even unexploited, the path guarantees a `refcount_t: underflow; use-after-free` WARN, a SLUB double-free BUG, and oopses in `drm_minor_unregister()`/`device_del()` on freed pointers, crashing the kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:09:58.917Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f7482516002a11317912e29577bbf33cf59a0fb1"
        },
        {
          "url": "https://git.kernel.org/stable/c/2413bbd1d692aed245c2aa38a369a1fa7590db84"
        },
        {
          "url": "https://git.kernel.org/stable/c/3328443363a0895fd9c096edfe8ecd372ca9145e"
        }
      ],
      "title": "drm/radeon: Do not kfree() devres managed rdev",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-68170",
    "datePublished": "2025-12-16T13:42:50.201Z",
    "dateReserved": "2025-12-16T13:41:40.251Z",
    "dateUpdated": "2026-08-05T12:09:58.917Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-68170",
      "date": "2026-08-10",
      "epss": "0.00135",
      "percentile": "0.03389"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-68170\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-12-16T14:15:48.873\",\"lastModified\":\"2026-07-30T06:24:31.833\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/radeon: Do not kfree() devres managed rdev\\n\\nSince the allocation of the drivers main structure was changed to\\ndevm_drm_dev_alloc() rdev is managed by devres and we shouldn\u0027t be calling\\nkfree() on it.\\n\\nThis fixes things exploding if the driver probe fails and devres cleans up\\nthe rdev after we already free\u0027d it.\\n\\n(cherry picked from commit 16c0681617b8a045773d4d87b6140002fa75b03b)\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/gpu/drm/radeon/radeon_kms.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"a9ed2f052c5c14e4be58c5ec8794dffc87588123\",\"lessThan\":\"f7482516002a11317912e29577bbf33cf59a0fb1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a9ed2f052c5c14e4be58c5ec8794dffc87588123\",\"lessThan\":\"2413bbd1d692aed245c2aa38a369a1fa7590db84\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a9ed2f052c5c14e4be58c5ec8794dffc87588123\",\"lessThan\":\"3328443363a0895fd9c096edfe8ecd372ca9145e\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/gpu/drm/radeon/radeon_kms.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.12\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.12\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.58\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.17.8\",\"lessThanOrEqual\":\"6.17.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2413bbd1d692aed245c2aa38a369a1fa7590db84\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/3328443363a0895fd9c096edfe8ecd372ca9145e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f7482516002a11317912e29577bbf33cf59a0fb1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-07-30T10:07:37+00:00",
      "cve": "CVE-2025-68170",
      "id": "CVE-2025-68170",
      "initial_release_date": "2025-12-16T00:00:00+00:00",
      "product_status:known_affected": "198",
      "product_status:known_not_affected": "76",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drm/radeon: Do not kfree() devres managed rdev",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-68170.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-25T00:28:03Z",
      "cve": "CVE-2025-68170",
      "id": "CVE-2025-68170",
      "initial_release_date": "2025-12-17T00:26:23Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "394",
      "product_status:known_not_affected": "358",
      "product_status:recommended": "283",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-68170",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-68170.json",
      "version": "25"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.