CVE-2025-68170

In the Linux kernel, the following vulnerability has been resolved:

drm/radeon: Do not kfree() devres managed rdev

Since the allocation of the drivers main structure was changed to devm_drm_dev_alloc() rdev is managed by devres and we shouldn't be calling kfree() on it.

This fixes things exploding if the driver probe fails and devres cleans up the rdev after we already free'd it.

(cherry picked from commit 16c0681617b8a045773d4d87b6140002fa75b03b)

A flaw was found in the Linux kernel drm/radeon driver (drivers/gpu/drm/radeon/radeon_kms.c), rated by Red Hat as low impact. After the driver's main structure (rdev) was changed to be allocated with devm_drm_dev_alloc(), rdev became managed by devres, but the driver's error path still calls kfree() on it. If the radeon driver probe fails, devres cleanup releases rdev after it has already been freed, resulting in a double free that can crash the kernel and cause a denial of service. The Red Hat CVSS vector reflects a local attack vector requiring low privileges, with impact to availability only. In Red Hat Enterprise Linux, this flaw affects the kernel and kernel-rt in RHEL 9.6.z, 9.7.z, and 9.8, and the kernel in RHEL 10.0.z, 10.1.z, and 10.2, where the vulnerable code was introduced with the backport of upstream DRM changes (v6.11..v6.12). RHEL 7 and 8, the earlier RHEL 9.0.0.z, 9.2.0.z, and 9.4.z streams, and Red Hat In-Vehicle OS 1.1 are not affected because the vulnerable code is not present in those streams, and RHEL 6 ELS is out of support scope. The fix for the affected streams is currently deferred given the low impact of this issue; the residual risk is limited to a kernel crash (denial of service) on systems where the radeon graphics driver probe fails. Red Hat's severity assessment (CVSS 5.5, availability impact only) is lower than the upstream CVE.org score of 7.8, which additionally claims confidentiality and integrity impact that this flaw does not provide.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.