CVE-2025-68170drm/radeon: Do not kfree() devres managed rdev
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: drm/radeon: Do not kfree() devres managed rdev Since the allocation of the drivers main structure was changed to devm_drm_dev_alloc() rdev is managed by devres and we shouldn't be calling kfree() on it. This fixes things exploding if the driver probe fails and devres cleans up the rdev after we already free'd it. (cherry picked from commit 16c0681617b8a045773d4d87b6140002fa75b03b)
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Deferred
- Record last updated
- Oct 15, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from a9ed2f052c5c14e4be58c5ec8794dffc87588123 before f7482516002a11317912e29577bbf33cf59a0fb1; from a9ed2f052c5c14e4be58c5ec8794dffc87588123 before 2413bbd1d692aed245c2aa38a369a1fa7590db84; from a9ed2f052c5c14e4be58c5ec8794dffc87588123 before 3328443363a0895fd9c096edfe8ecd372ca9145e | CNA record |
References
- https://git.kernel.org/stable/c/f7482516002a11317912e29577bbf33cf59a0fb1
- https://git.kernel.org/stable/c/2413bbd1d692aed245c2aa38a369a1fa7590db84
- https://git.kernel.org/stable/c/3328443363a0895fd9c096edfe8ecd372ca9145e
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.