CVE-2025-68170

What it actually does

Double-free / use-after-free on the rdev structure because kfree() is called on memory that devm_drm_dev_alloc() has already registered for automatic release by the device resource manager; the second release occurs when a failing probe triggers devres cleanup.

Why it matters to the business

Kernel crashes or memory corruption can occur on systems using Radeon graphics during driver initialization failures, leading to unexpected reboots, loss of display functionality, and potential local privilege escalation on affected Ubuntu 20.04 LTS installations; the issue affects a broad set of cloud and server kernel packages with high ecosystem prevalence.

How an attack unfolds

An attacker with local access forces the Radeon probe to fail (for example by supplying a malformed device tree entry or triggering an early error path) so that the driver’s explicit kfree() and the subsequent devres-managed release both act on the same rdev pointer, producing a use-after-free that can be leveraged for memory corruption or code execution.

How to fix it

Upgrade to a fixed kernel package version for each affected flavor: linux 5.4.0-9.12, linux-aws 5.4.0-1005.5, linux-aws-5.15 5.15.0-1014.18~20.04.1, linux-azure 5.4.0-1006.6, linux-azure-5.15 5.15.0-1007.8~20.04.1, linux-azure-fde-5.15 5.15.0-1019.24~20.04.1.1, linux-bluefield 5.4.0-1007.10, linux-gcp 5.4.0-1005.5, linux-gcp-5.15 5.15.0-1006.9~20.04.1, linux-gkeop 5.4.0-1008.9, linux-gkeop-5.15 5.15.0-1003.5~20.04.2, linux-hwe-5.15 5.15.0-33.34~20.04.1, linux-ibm 5.4.0-1003.4.

How to confirm the fix worked

Verify the running kernel version matches or exceeds one of the listed fixed packages, then attempt to load the radeon module under conditions that previously caused probe failure and confirm no double-free or oops occurs in dmesg.

Typical attack path

1. Obtain local access on a system with a Radeon GPU using an affected kernel
2. Trigger conditions that cause the radeon driver probe to return an error
3. Allow the kernel to invoke both the manual kfree and the devres cleanup path
4. Exploit the resulting use-after-free for memory corruption or privilege escalation

How to detect it

Search kernel logs (dmesg, /var/log/kern.log, journalctl) for oops or panic messages referencing radeon, drm_dev_alloc, or kfree on the rdev structure during module load or probe failure; no public exploit artifacts are known.

What your security team should do

• Apply the listed fixed kernel packages immediately on all Ubuntu 20.04 LTS systems that use the affected linux, linux-aws, linux-azure, linux-gcp and related flavors
• Prioritize systems that expose Radeon hardware or run in environments where local users can influence driver loading
• Reboot into the updated kernels and monitor for any remaining probe-related oops after deployment