Skip to main content

Linux Kernel CVE-2025-68181

HIGH
2025-12-16 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux Red Hat Suse
High
Disputed · 7.8 Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Sources disagree (Low–High)
Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
6.4 MEDIUM

Triggering needs local privileged driver unbind/probe-failure and winning a free-reuse race, so PR:H and AC:H; a won UAF can still yield full kernel C/I/A impact.

3.1 AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
4.7 LOW
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Jul 30, 2026 - 07:26 vuln.today
CVE Published
Dec 16, 2025 - 14:15 cve.org
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

drm/radeon: Remove calls to drm_put_dev()

Since the allocation of the drivers main structure was changed to devm_drm_dev_alloc() drm_put_dev()'ing to trigger it to be free'd should be done by devres.

However, drm_put_dev() is still in the probe error and device remove paths. When the driver fails to probe warnings like the following are shown because devres is trying to drm_put_dev() after the driver already did it.

[ 5.642230] radeon 0000:01:05.0: probe with driver radeon failed with error -22 [ 5.649605] ------------[ cut here ]------------ [ 5.649607] refcount_t: underflow; use-after-free. [ 5.649620] WARNING: CPU: 0 PID: 357 at lib/refcount.c:28 refcount_warn_saturate+0xbe/0x110

(cherry picked from commit 3eb8c0b4c091da0a623ade0d3ee7aa4a93df1ea4)

AnalysisAI

Local privilege-escalation-class use-after-free in the Linux kernel's radeon (AMD GPU) DRM driver, triggered on the probe-error and device-removal paths. After the driver switched its main structure to devm_drm_dev_alloc(), the leftover drm_put_dev() calls cause devres to release the already-freed device a second time, producing a refcount underflow ('refcount_t: underflow; use-after-free') and dangling reference. No public exploit identified at time of analysis; EPSS is low at 0.17% (7th percentile) and the issue is not listed in CISA KEV.

Technical ContextAI

The affected component is the DRM (Direct Rendering Manager) kernel subsystem, specifically the radeon driver that serves AMD/ATI Radeon GPUs. Modern DRM drivers allocate their top-level drm_device via the managed helper devm_drm_dev_alloc(), which registers the structure with the devres (device-managed resources) framework so it is automatically released when the underlying device goes away. The bug is a device-lifetime/reference-counting defect (root-cause class CWE-416 Use-After-Free, arising from a double-free of the drm_device): the radeon probe-error and remove paths still explicitly called the legacy drm_put_dev(), so devres later tried to free the same object again, driving the refcount below zero and dereferencing freed memory. CWE is listed as N/A in the input, so the CWE-416 classification is inferred from the described refcount underflow / use-after-free behavior.

Affected ProductsAI

The affected product is the mainline/stable Linux kernel, specifically the drm/radeon driver for AMD Radeon graphics hardware. Exact vulnerable version ranges are not enumerated in the input; the fix is distributed as a cherry-pick (upstream commit 3eb8c0b4c091da0a623ade0d3ee7aa4a93df1ea4) backported across stable branches via git.kernel.org commits 2fa41445d8c98f2a65503c373796466496edc0e7, 745bae76acdd71709773c129a69deca01036250b, and ec18f6b2c743cc471b2539ddb5caed20a012e640. Only kernels built with the radeon DRM driver and running on systems with Radeon GPUs are in scope; no NVD CPE list was provided, so precise affected versions should be confirmed against each distribution's kernel changelog.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - apply the kernel update from your distribution that incorporates the radeon change 'drm/radeon: Remove calls to drm_put_dev()' (upstream commit 3eb8c0b4c091da0a623ade0d3ee7aa4a93df1ea4, backported via https://git.kernel.org/stable/c/2fa41445d8c98f2a65503c373796466496edc0e7, https://git.kernel.org/stable/c/745bae76acdd71709773c129a69deca01036250b, and https://git.kernel.org/stable/c/ec18f6b2c743cc471b2539ddb5caed20a012e640). Track the specific stable/LTS tag and vendor kernel that carries these commits and upgrade to it, then reboot. As interim compensating controls where patching must be deferred: avoid triggering the vulnerable path by not manually unbinding/removing the radeon driver via sysfs (side effect: no dynamic GPU driver reload), and restrict local administrative access so unprivileged users cannot invoke device removal; on systems that do not use Radeon hardware, blacklisting the radeon module removes exposure entirely at the cost of losing that driver.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.0/baremetal-os-container:latest Container suse/sl-micro/6.0/base-os-container:latest Container suse/sl-micro/6.0/kvm-os-container:latest Container suse/sl-micro/6.0/rt-os-container:latest Image SL-Micro Affected
Container suse/sl-micro/6.0/toolbox:latest Affected
Image SLES-Azure-3P Image SLES-Azure-Basic Image SLES-Azure-Standard Image SLES-BYOS-Azure Image SLES-BYOS-EC2 Image SLES-BYOS-GCE Image SLES-CHOST-BYOS-Aliyun Image SLES-CHOST-BYOS-Azure Image SLES-CHOST-BYOS-EC2 Image SLES-CHOST-BYOS-GCE Image SLES-CHOST-BYOS-GDC Image SLES-CHOST-BYOS-SAP-CCloud Image SLES-EC2 Image SLES-EC2-ECS Image SLES-GCE Image SLES-GCE-3P Image SLES-Hardened-BYOS-Azure Image SLES-Hardened-BYOS-EC2 Image SLES-Hardened-BYOS-GCE Image SLES-SAPCAL-Azure Image SLES-SAPCAL-EC2 Image SLES-SAPCAL-GCE Affected
Image SLES-SAP-Azure Image SLES-SAP-Azure-3P Image SLES-SAP-BYOS-Azure Image SLES-SAP-BYOS-EC2 Image SLES-SAP-BYOS-GCE Image SLES-SAP-EC2 Image SLES-SAP-GCE Image SLES-SAP-GCE-3P Affected
Image SLES15-SP7-Azure-3P Image SLES15-SP7-Azure-Basic Image SLES15-SP7-Azure-Standard Image SLES15-SP7-HPC-Azure Affected

Share

CVE-2025-68181 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy