Vulnerability-Lookup

GHSA-8RP7-MG54-F432

Vulnerability from github – Published: 2025-12-16 15:30 – Updated: 2026-07-30 06:32

Details

In the Linux kernel, the following vulnerability has been resolved:

drm/radeon: Do not kfree() devres managed rdev

Since the allocation of the drivers main structure was changed to devm_drm_dev_alloc() rdev is managed by devres and we shouldn't be calling kfree() on it.

This fixes things exploding if the driver probe fails and devres cleans up the rdev after we already free'd it.

(cherry picked from commit 16c0681617b8a045773d4d87b6140002fa75b03b)

Severity

7.8 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-68170"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-12-16T14:15:48Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/radeon: Do not kfree() devres managed rdev\n\nSince the allocation of the drivers main structure was changed to\ndevm_drm_dev_alloc() rdev is managed by devres and we shouldn\u0027t be calling\nkfree() on it.\n\nThis fixes things exploding if the driver probe fails and devres cleans up\nthe rdev after we already free\u0027d it.\n\n(cherry picked from commit 16c0681617b8a045773d4d87b6140002fa75b03b)",
  "id": "GHSA-8rp7-mg54-f432",
  "modified": "2026-07-30T06:32:24Z",
  "published": "2025-12-16T15:30:44Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68170"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/2413bbd1d692aed245c2aa38a369a1fa7590db84"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/3328443363a0895fd9c096edfe8ecd372ca9145e"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/f7482516002a11317912e29577bbf33cf59a0fb1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2025-68170 (GCVE-0-2025-68170)

Vulnerability from cvelistv5 – Published: 2025-12-16 13:42 – Updated: 2026-08-05 12:09

Title

drm/radeon: Do not kfree() devres managed rdev

Summary

In the Linux kernel, the following vulnerability has been resolved: drm/radeon: Do not kfree() devres managed rdev Since the allocation of the drivers main structure was changed to devm_drm_dev_alloc() rdev is managed by devres and we shouldn't be calling kfree() on it. This fixes things exploding if the driver probe fails and devres cleans up the rdev after we already free'd it. (cherry picked from commit 16c0681617b8a045773d4d87b6140002fa75b03b)

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6665 records in the last 180 days details

References

3 references

URL	Tags
https://git.kernel.org/stable/c/f7482516002a11317…
https://git.kernel.org/stable/c/2413bbd1d692aed24…
https://git.kernel.org/stable/c/3328443363a0895fd…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: a9ed2f052c5c14e4be58c5ec8794dffc87588123 , < f7482516002a11317912e29577bbf33cf59a0fb1 (git) Affected: a9ed2f052c5c14e4be58c5ec8794dffc87588123 , < 2413bbd1d692aed245c2aa38a369a1fa7590db84 (git) Affected: a9ed2f052c5c14e4be58c5ec8794dffc87588123 , < 3328443363a0895fd9c096edfe8ecd372ca9145e (git)
Linux	Linux	Affected: 6.12 Unaffected: 0 , < 6.12 (semver) Unaffected: 6.12.58 , ≤ 6.12.* (semver) Unaffected: 6.17.8 , ≤ 6.17.* (semver) Unaffected: 6.18 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/radeon/radeon_kms.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f7482516002a11317912e29577bbf33cf59a0fb1",
              "status": "affected",
              "version": "a9ed2f052c5c14e4be58c5ec8794dffc87588123",
              "versionType": "git"
            },
            {
              "lessThan": "2413bbd1d692aed245c2aa38a369a1fa7590db84",
              "status": "affected",
              "version": "a9ed2f052c5c14e4be58c5ec8794dffc87588123",
              "versionType": "git"
            },
            {
              "lessThan": "3328443363a0895fd9c096edfe8ecd372ca9145e",
              "status": "affected",
              "version": "a9ed2f052c5c14e4be58c5ec8794dffc87588123",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/radeon/radeon_kms.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.12"
            },
            {
              "lessThan": "6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.58",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.58",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.8",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/radeon: Do not kfree() devres managed rdev\n\nSince the allocation of the drivers main structure was changed to\ndevm_drm_dev_alloc() rdev is managed by devres and we shouldn\u0027t be calling\nkfree() on it.\n\nThis fixes things exploding if the driver probe fails and devres cleans up\nthe rdev after we already free\u0027d it.\n\n(cherry picked from commit 16c0681617b8a045773d4d87b6140002fa75b03b)"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is a PCI/DRM driver teardown path reached only from local system operations (driver probe failure, sysfs unbind, module unload, PCI hot-remove, VM shutdown), and the resulting freed-slab primitive is consumed locally via heap grooming and concurrent `/dev/dri/*` ioctls. No network or adjacent-network input reaches it.\nAC:L - This is a deterministic double free, not a race \u2014 once `radeon_driver_unload_kms()` runs, `kfree(rdev)` always precedes the devres/drm-managed release of the same allocation, and the subsequent UAF dereferences in `drm_dev_unregister()`/`drm_dev_release()` occur unconditionally. Slab reclaim of the freed container is groomable by the attacker with ordinary allocation pressure.\nPR:L - Consistent with how this CNA scores probe/remove-path devres-lifetime corruption, an unprivileged local user is the one who weaponizes it: the primary and render minors are still registered when `kfree(rdev)` runs, so a low-privileged process holding an open `/dev/dri/renderD128` (world-accessible on essentially all distros and on Android) can spray the freed container and drive ioctls against the freed `drm_device` while a routine removal event \u2014 eGPU/Thunderbolt unplug, PCI hot-remove, VM reboot, or boot-time probe failure \u2014 supplies the trigger.\nUI:N - No action by a separate victim user is needed; the boot-time probe-failure path and the in-VM `radeon_pci_shutdown()` \u2192 `radeon_pci_remove()` path fire as part of normal system operation, and the attacker\u0027s spray/exploit steps require no interaction.\nS:U - The corruption is confined to the kernel\u0027s own slab allocator and DRM device state, within the same security authority; no hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - After the free, `drm_minor_unregister()` and `drm_managed_release()` re-read `dev-\u003eprimary`, `dev-\u003erender`, `dev-\u003eaccel` and the `dev-\u003emanaged.resources` list out of the freed allocation, and open render-node fds still dereference the freed `drm_device`/`rdev`; an attacker who reclaims the slab gets a use-after-free read primitive usable for kernel memory disclosure.\nI:H - `drm_managed_release()` performs an indirect call through `dr-\u003enode.release()` read from freed memory, and `drm_dev_release()` then does `kfree(dev-\u003emanaged.final_kfree)` on a pointer read from freed memory \u2014 a control-flow hijack plus arbitrary/double-free primitive, compounded by the `kref_put()` write into freed memory.\nA:H - Even unexploited, the path guarantees a `refcount_t: underflow; use-after-free` WARN, a SLUB double-free BUG, and oopses in `drm_minor_unregister()`/`device_del()` on freed pointers, crashing the kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:09:58.917Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f7482516002a11317912e29577bbf33cf59a0fb1"
        },
        {
          "url": "https://git.kernel.org/stable/c/2413bbd1d692aed245c2aa38a369a1fa7590db84"
        },
        {
          "url": "https://git.kernel.org/stable/c/3328443363a0895fd9c096edfe8ecd372ca9145e"
        }
      ],
      "title": "drm/radeon: Do not kfree() devres managed rdev",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-68170",
    "datePublished": "2025-12-16T13:42:50.201Z",
    "dateReserved": "2025-12-16T13:41:40.251Z",
    "dateUpdated": "2026-08-05T12:09:58.917Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted