CVE-2025-68172: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68172 is a double-free vulnerability in the Linux kernel's ASPEED cryptographic accelerator (aspeed-acry) driver. The flaw arises because a clock resource obtained via devm_clk_get_enabled() is automatically managed by the device resource (devres) framework, yet the driver also manually calls clk_disable_unprepare() in both the error path of aspeed_acry_probe() and in aspeed_acry_remove(), resulting in a double free. It was published on December 16, 2025, and affects Linux kernel versions from 6.3 up to the patched stable releases. The CVSS estimate is Medium severity, with an EPSS score of approximately 0.018% (Feedly, EUVD).

The root cause is a double-free memory management error (CWE-415) in the Linux kernel's drivers/crypto/aspeed/aspeed-acry.c. When devm_clk_get_enabled() is used to acquire a clock, the devres framework automatically handles its cleanup (disable and free) upon driver detach. However, the driver redundantly calls clk_disable_unprepare() manually in the error-handling path of aspeed_acry_probe() and again in aspeed_acry_remove(), causing the clock to be freed twice. The fix removes these manual cleanup calls, relying solely on devres for lifecycle management. Patches are available in the upstream kernel stable trees (Feedly, EUVD).

Exploitation of this double-free vulnerability could lead to kernel memory corruption, potentially causing a system crash (denial of service) or, in more severe scenarios, enabling privilege escalation or arbitrary code execution in kernel context. The vulnerability is confined to systems using ASPEED SoC hardware (e.g., BMC/server management chips) with the aspeed-acry crypto driver loaded. The practical impact is primarily availability (kernel panic/crash), though memory corruption bugs of this class can sometimes be leveraged for privilege escalation by a local attacker (Feedly).

The Linux kernel stable trees have been patched across multiple branches. Fixed versions include Linux 6.6.117, 6.12.58, 6.17.8, and 6.18 (mainline). The patches remove the redundant manual clk_disable_unprepare() calls from aspeed_acry_probe()'s error path and aspeed_acry_remove(), delegating clock cleanup entirely to the devres framework. Users running affected kernels on ASPEED-based hardware should update to a patched kernel version as soon as possible. Patch commits are available in the upstream stable kernel repositories (EUVD, Feedly).