Skip to main content

Linux Kernel CVE-2025-68170

HIGH
2025-12-16 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux Red Hat Suse
High
Disputed · 7.8 Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Sources disagree (Low–High)
Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
5.8 MEDIUM

Local-only (AV:L); triggering a probe failure is not attacker-controlled on demand (AC:H); needs a local user (PR:L); realistic impact is a kernel crash (A:H) with only speculative UAF-based C/I (L).

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 LOW
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Jul 30, 2026 - 07:30 vuln.today
CVE Published
Dec 16, 2025 - 14:15 cve.org
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

drm/radeon: Do not kfree() devres managed rdev

Since the allocation of the drivers main structure was changed to devm_drm_dev_alloc() rdev is managed by devres and we shouldn't be calling kfree() on it.

This fixes things exploding if the driver probe fails and devres cleans up the rdev after we already free'd it.

(cherry picked from commit 16c0681617b8a045773d4d87b6140002fa75b03b)

AnalysisAI

Kernel memory corruption in the Linux drm/radeon GPU driver occurs because the driver calls kfree() on the rdev main structure that is now managed by devres (via devm_drm_dev_alloc()), causing a double-free when the driver probe fails and devres later cleans up the already-freed allocation. Local users on systems with AMD/ATI Radeon hardware may trigger memory corruption during a failed driver probe, most directly resulting in a kernel crash. There is no public exploit identified at time of analysis, and the EPSS score is low (0.17%, 7th percentile), consistent with an error-path bug rather than a broadly exploitable flaw.

Technical ContextAI

The affected code is the legacy drm/radeon Direct Rendering Manager driver, which serves older AMD/ATI Radeon GPUs (as distinct from the newer amdgpu driver). The root cause is a lifetime-management mismatch: the driver's main structure (rdev) allocation was migrated to the device-managed devm_drm_dev_alloc() API, meaning its lifetime is now owned by the devres subsystem, yet the cleanup path still explicitly called kfree() on it. This double frees the same allocation - a memory-management error class (CWE-415 Double Free / CWE-416 Use-After-Free; the input lists CWE as N/A). The fix, cherry-picked from upstream commit 16c0681617b8, removes the erroneous kfree() so devres remains the sole owner of the rdev object.

Affected ProductsAI

The vulnerability affects the Linux kernel's drm/radeon driver on systems using AMD/ATI Radeon GPUs, specifically kernel versions after the switch to devm_drm_dev_alloc() for the rdev structure and before the fix. No CPE strings were provided in the input, so exact affected version ranges are not enumerated here; the three git.kernel.org references (commits 2413bbd1d692, 3328443363a0, f7482516002a) indicate the fix was applied across multiple stable branches. Consult the kernel stable trees at https://git.kernel.org/stable/c/f7482516002a11317912e29577bbf33cf59a0fb1 to map the fix commits to the stable release tags shipped by your distribution.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - apply the kernel update from your distribution that incorporates the fix commits (backported from upstream 16c0681617b8), available via https://git.kernel.org/stable/c/2413bbd1d692aed245c2aa38a369a1fa7590db84, https://git.kernel.org/stable/c/3328443363a0895fd9c096edfe8ecd372ca9145e, and https://git.kernel.org/stable/c/f7482516002a11317912e29577bbf33cf59a0fb1. Since no tagged release version is specified in the input, track your distribution's kernel security updates and install the first build referencing this CVE or the radeon devres double-free fix. As a compensating control on systems that do not require the legacy radeon driver, blacklist the module (add 'blacklist radeon' in /etc/modprobe.d/ and rebuild initramfs) to prevent the vulnerable probe path from ever loading - the trade-off is loss of acceleration/display support for affected Radeon GPUs, so verify no such hardware is in use first; note this does not help systems that legitimately depend on Radeon graphics.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.0/baremetal-os-container:latest Container suse/sl-micro/6.0/base-os-container:latest Container suse/sl-micro/6.0/kvm-os-container:latest Container suse/sl-micro/6.0/rt-os-container:latest Image SL-Micro Affected
Container suse/sl-micro/6.0/toolbox:latest Affected
Image SLES-Azure-3P Image SLES-Azure-Basic Image SLES-Azure-Standard Image SLES-BYOS-Azure Image SLES-BYOS-EC2 Image SLES-BYOS-GCE Image SLES-CHOST-BYOS-Aliyun Image SLES-CHOST-BYOS-Azure Image SLES-CHOST-BYOS-EC2 Image SLES-CHOST-BYOS-GCE Image SLES-CHOST-BYOS-GDC Image SLES-CHOST-BYOS-SAP-CCloud Image SLES-EC2 Image SLES-EC2-ECS Image SLES-GCE Image SLES-GCE-3P Image SLES-Hardened-BYOS-Azure Image SLES-Hardened-BYOS-EC2 Image SLES-Hardened-BYOS-GCE Image SLES-SAPCAL-Azure Image SLES-SAPCAL-EC2 Image SLES-SAPCAL-GCE Affected
Image SLES-SAP-Azure Image SLES-SAP-Azure-3P Image SLES-SAP-BYOS-Azure Image SLES-SAP-BYOS-EC2 Image SLES-SAP-BYOS-GCE Image SLES-SAP-EC2 Image SLES-SAP-GCE Image SLES-SAP-GCE-3P Affected
Image SLES15-SP7-Azure-3P Image SLES15-SP7-Azure-Basic Image SLES15-SP7-Azure-Standard Image SLES15-SP7-HPC-Azure Affected

Share

CVE-2025-68170 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy