CVE-2025-68181: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68181 is a use-after-free vulnerability in the Linux kernel's drm/radeon GPU driver, caused by redundant calls to drm_put_dev() in probe error and device removal paths. When the driver's main structure allocation was migrated to devm_drm_dev_alloc(), the devres framework became responsible for freeing the structure; however, explicit drm_put_dev() calls were left in place, resulting in a double-free and refcount underflow condition. The vulnerability was published on December 16, 2025, and affects Linux kernel versions from commit a9ed2f052c5c up to the patched releases. The EPSS score is approximately 0.017% (very low), and no CVSS base score has been formally assigned (Feedly, ENISA EUVD).

The root cause is a use-after-free (CWE-416) triggered by a double invocation of drm_put_dev() in the drm/radeon driver. When devm_drm_dev_alloc() is used to allocate the DRM device structure, the devres framework automatically calls the appropriate cleanup function on driver detach or probe failure. Because drm_put_dev() was also explicitly called in the probe error path and device remove path, the reference count on the DRM device underflows, producing a refcount_t: underflow; use-after-free kernel warning at lib/refcount.c:28. The fix, cherry-picked from upstream commit 3eb8c0b4c091da0a623ade0d3ee7aa4a93df1ea4, removes the redundant drm_put_dev() calls so that devres exclusively manages the object lifetime (Feedly, kernel.org patch 6.12.58).

Exploitation of this vulnerability could lead to kernel memory corruption via a use-after-free condition in the radeon DRM driver, potentially causing a system crash (denial of service) or, in more severe scenarios, enabling local privilege escalation if the freed memory is reclaimed and manipulated by an attacker. The impact is primarily limited to systems with AMD Radeon GPUs using the radeon kernel driver. Confidentiality and integrity impacts are theoretically possible if an attacker can control the reuse of freed memory, but the practical exploitation complexity is high (Feedly).

The Linux kernel has released patches addressing this vulnerability in the following stable versions: 6.12.58, 6.17.8, and 6.18. The fix removes the redundant drm_put_dev() calls from the drm/radeon driver's probe error and device remove paths, delegating cleanup exclusively to the devres framework. Users should update their Linux kernel to one of the patched versions as soon as possible. As a temporary workaround, systems without AMD Radeon GPUs or those not loading the radeon kernel module are not affected (kernel.org patch 6.12.58, kernel.org patch 6.17.8, kernel.org patch 6.18).