CVE-2025-68754: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-68754 is a double free vulnerability in the Linux kernel's rtc-amlogic-a4 (Amlogic A4 RTC) driver. The flaw arises because the clock resource obtained via devm_clk_get_enabled() is automatically managed by the kernel's devres framework, yet the driver also manually calls clk_disable_unprepare() in its probe error path and aml_rtc_remove() function, resulting in a double free condition. The vulnerability was published on January 5, 2026, and affects the Linux kernel on systems using the Amlogic A4 RTC driver. No CVSS score has been formally assigned by NVD; Feedly estimates the severity as Medium with an EPSS score of 0.000170 (Red Hat CVE, Feedly).

The root cause is a double free (CWE-415) in the rtc-amlogic-a4 kernel driver. When a clock is acquired using devm_clk_get_enabled(), the devres framework automatically handles its cleanup (disabling and freeing) upon driver detach. The driver incorrectly also calls clk_disable_unprepare() manually in both the probe error path and the aml_rtc_remove() function, causing the clock resource to be freed twice. The fix removes the redundant clk_disable_unprepare() calls, delegating full lifecycle management to the devm framework (Red Hat CVE, kernel.org patch 1).

A double free vulnerability in a kernel driver can lead to memory corruption and system instability. In the worst case, an attacker or unprivileged local user who can trigger driver probe or removal scenarios (e.g., by hotplugging the affected device) could potentially cause a denial of service (kernel panic/crash) or, under specific memory layout conditions, achieve arbitrary code execution in kernel context. The scope is limited to systems running Linux kernels with the Amlogic A4 RTC driver loaded (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is very low at 0.000170, reflecting minimal exploitation probability. Detection plugins are available from Nessus (plugin 281905) and Qualys (IDs 6032583, 6032596, 6032625, 6032688) (Feedly).

Apply the upstream Linux kernel patches that remove the redundant clk_disable_unprepare() calls from the rtc-amlogic-a4 driver's probe error path and aml_rtc_remove() function. Three patch commits are available via kernel.org stable trees. Distributions such as Red Hat have tracked this issue; users should update to a kernel version that includes the fix. No configuration-based workaround is documented; upgrading the kernel is the recommended remediation (Red Hat CVE, kernel.org patch 1, kernel.org patch 2, kernel.org patch 3).