---
id: CVE-2025-68170
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  drm/radeon: Do not kfree() devres managed rdev

  Since the allocation of the drivers main structure was changed to
  devm_drm_dev_alloc() rdev is managed by devres and we …
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  drm/radeon: Do not kfree() devres managed rdev

  Since the allocation of the drivers main structure was changed to
  devm_drm_dev_alloc() rdev is managed by devres and we …
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-763
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= a9ed2f052c5c14e4be58c5ec8794dffc87588123 <
    f7482516002a11317912e29577bbf33cf59a0fb1
  - >-
    Linux >= a9ed2f052c5c14e4be58c5ec8794dffc87588123 <
    2413bbd1d692aed245c2aa38a369a1fa7590db84
  - >-
    Linux >= a9ed2f052c5c14e4be58c5ec8794dffc87588123 <
    3328443363a0895fd9c096edfe8ecd372ca9145e
  - Linux 6.12
published: '2025-12-16'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T22:19:09.377'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-68170'
references:
  - url: 'https://git.kernel.org/stable/c/2413bbd1d692aed245c2aa38a369a1fa7590db84'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/3328443363a0895fd9c096edfe8ecd372ca9145e'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/f7482516002a11317912e29577bbf33cf59a0fb1'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-68170.json
  - url: 'https://access.redhat.com/security/cve/CVE-2025-68170'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2422735'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2025-68170'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-68170'
  - url: >-
      https://lore.kernel.org/linux-cve-announce/2025121628-CVE-2025-68170-6a22@gregkh/T
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
  - score-dispute
epss: 0.00152
epssPercentile: 0.04339
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-15T21:59:43.761321Z'
scores:
  nvd: 7.8
  vendor: 5.5
ingestedAt: '2026-10-14T13:30:58.443Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

drm/radeon: Do not kfree() devres managed rdev

Since the allocation of the drivers main structure was changed to
devm_drm_dev_alloc() rdev is managed by devres and we shouldn't be calling
kfree() on it.

This fixes things exploding if the driver probe fails and devres cleans up
the rdev after we already free'd it.

(cherry picked from commit 16c0681617b8a045773d4d87b6140002fa75b03b)

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Low · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-68170.json)