Executive brief
A vulnerability exists in the Linux kernel's Radeon graphics driver that could lead to a system crash or unauthorized data access. The issue occurs when the system incorrectly handles the cleanup process for graphics hardware, potentially allowing a local user to trigger a memory error. This could impact the stability of the operating system and the security of data processed by the graphics card.
Technical details
A use-after-free (UAF) vulnerability exists in the Linux kernel's Radeon Direct Rendering Manager (DRM) driver (drivers/gpu/drm/radeon/radeon_drv.c). The root cause is a double-free condition resulting from redundant calls to drm_put_dev() in the probe error and device removal paths. Because the driver was updated to use devm_drm_dev_alloc(), the device resource management (devres) system automatically handles cleanup; manual calls to drm_put_dev() trigger a refcount_t underflow. A local attacker could potentially exploit this memory corruption to achieve privilege escalation or cause a denial-of-service (kernel panic). The issue has been resolved by removing the redundant manual cleanup calls in the affected driver paths.
Affected products
- Linux Linux Kernel 6.12, 6.17, 6.18
Timeline
- 2025-10-18: disclosed: Initial patch authored
- 2025-12-16: advisory: CVE published by kernel.org