CVE-2025-68181

Root

Cause

The commit addresses a use-after-free bug in the Linux kernel's drm/radeon driver. The driver's main structure allocation was changed to devm_drm_dev_alloc(), which means its lifetime is managed by the devres framework and should be freed automatically. However, the probe error and device removal paths still contained explicit calls to drm_put_dev(). This leads to a double-free scenario when the driver fails to probe: first by the explicit drm_put_dev() call, and then again by devres, triggering a refcount underflow warning and potential use-after-free [1].

Exploitation

This vulnerability is triggered during driver probe failure on affected systems, such as when an unsupported or malfunctioning Radeon GPU is encountered. The attacker would need to cause the driver to fail probing, for example by passing a malformed device or exploiting hardware configuration. No authentication is required, but the attack surface is local or physical access to influence device enumeration [1].

Impact

The primary impact is a kernel memory safety issue: a refcount underflow leading to a use-after-free condition. This can result in a denial of service (kernel panic or crash) and, in theory, could be leveraged for local privilege escalation if an attacker can control the freed memory. The warning message explicitly shows a refcount underflow, confirming the double-free [1].

Mitigation

The fix, introduced in Linux kernel commit 3eb8c0b4c091da0a623ade0d3ee7aa4a93df1ea4 and backported as ec18f6b2c743cc471b2539ddb5caed20a012e640, removes the explicit drm_put_dev() calls from the probe error and remove paths, allowing devres to handle cleanup safely. Users should apply the stable kernel update containing this commit. No workaround is available other than avoiding hardware that triggers the probe failure or using mitigation techniques like KASLR [1].