CVE-2025-68181

What it actually does

Double invocation of drm_put_dev() on a device allocated via devm_drm_dev_alloc() in radeon probe error and remove paths triggers refcount underflow and use-after-free.

Why it matters to the business

Systems using older Radeon hardware may experience kernel warnings, potential instability, or crashes during driver load failures; low active threat but affects kernel stability on affected distributions.

How an attack unfolds

An attacker with local access induces a deliberate probe failure in the radeon driver to exercise the still-present drm_put_dev() call after devres has already freed the structure, producing the refcount underflow condition.

How to fix it

Update the Linux kernel to a version containing commit 2fa41445d8c98f2a65503c373796466496edc0e7 (or the equivalent cherry-pick 3eb8c0b4c091da0a623ade0d3ee7aa4a93df1ea4) that removes the remaining drm_put_dev() calls from error paths.

How to confirm the fix worked

Reproduce a radeon probe failure after patching and confirm the refcount underflow warning no longer appears; inspect dmesg for absence of the specific warning string.

Typical attack path

1. Obtain local execution context on a system with radeon hardware
2. Trigger conditions that cause the radeon driver probe to fail
3. Observe or exploit the resulting refcount underflow warning and potential use-after-free

How to detect it

Search kernel logs (dmesg, journalctl) for the exact strings indicating radeon probe failure followed by the refcount underflow warning; correlate with any subsequent use-after-free reports.

• refcount_t: underflow; use-after-free.
• radeon .* probe with driver radeon failed with error -22
• WARNING: CPU: .* at lib/refcount.c:28 refcount_warn_saturate

What your security team should do

• Prioritize kernel updates on systems exposing Radeon hardware
• Add the probe-failure warning strings to SIEM rules for early detection
• Review downstream distributions for backported fixes given the 315-day publication age