CVE-2025-68170: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68170 is a use-after-free vulnerability in the Linux kernel's drm/radeon driver caused by incorrectly calling kfree() on a devres-managed structure. When the driver's allocation of its main structure (rdev) was changed to use devm_drm_dev_alloc(), the memory became managed by the device resource (devres) framework; a subsequent explicit kfree() call on probe failure results in a double-free condition when devres later attempts its own cleanup. The vulnerability was published on December 16, 2025, and affects Linux kernel versions from commit a9ed2f052c5c up to the patched commits in stable branches. No CVSS score has been assigned at this time (Feedly, EUVD).

The root cause is a double-free / use-after-free memory management error (CWE-415/CWE-416) in the drm/radeon kernel driver. After the driver's main structure rdev was allocated via devm_drm_dev_alloc(), it became owned by the devres framework, which automatically frees it on device detach or probe failure. However, an explicit kfree(rdev) call remained in the probe failure path, freeing the memory prematurely; devres then attempts to free the same memory again, causing kernel instability or a crash. The fix, cherry-picked from upstream commit 16c0681617b8a045773d4d87b6140002fa75b03b, removes the erroneous kfree() call (Feedly, Linux Stable).

Exploitation of this vulnerability can cause a kernel crash (system panic or oops) on systems using the Radeon DRM driver, resulting in a denial of service. The double-free condition occurs during driver probe failure, meaning it is most likely triggered during hardware initialization or hot-plug events involving AMD Radeon GPUs. There is no evidence of confidentiality or integrity impact beyond system availability, and lateral movement potential is limited given the local/kernel-level nature of the bug (Feedly).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-68170. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Triggering the bug requires a scenario where the Radeon driver probe fails (e.g., hardware fault or misconfiguration), which limits practical exploitability to local or physical access contexts (Feedly).

The Linux kernel stable trees have been patched with fixes backported to multiple stable branches. Patched commits include f7482516002a (one stable branch), 2413bbd1d692 (another branch), and 3328443363a0 (a third branch), with patch versions noted as 6.12.58 and 6.17.8 (Feedly, Linux Stable). Users should update to a patched kernel version (≥6.12.58 for the 6.12 stable series, or ≥6.17.8 for the 6.17 series). As a workaround, systems without AMD Radeon GPUs are not affected; disabling or blacklisting the radeon kernel module (modprobe.blacklist=radeon) can mitigate exposure on systems that do not require the driver.