CVE-2025-68754: rtc: amlogic-a4: fix double free caused by devm
In the Linux kernel, the following vulnerability has been resolved:
rtc: amlogic-a4: fix double free caused by devm
The clock obtained via devmclkgetenabled() is automatically managed by devres and will be disabled and freed on driver detach. Manually calling clkdisableunprepare() in error path and remove function causes double free.
Remove the redundant clkdisableunprepare() calls from the probe error path and amlrtcremove(), allowing the devm framework to automatically manage the clock lifecycle.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Remove the redundant clk_disable_unprepare() calls from the probe error path and aml_rtc_remove(); devm_clk_get_enabled() automatically manages the clock lifecycle and disables and frees it on driver detach.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-68754?
CVE-2025-68754 is classified as a medium severity vulnerability due to the potential for double free leading to exploitability in the Linux kernel.
How do I fix CVE-2025-68754?
To fix CVE-2025-68754, update the Linux kernel to the latest version where the vulnerability is resolved.
What systems are affected by CVE-2025-68754?
CVE-2025-68754 affects specific versions of the Linux kernel, particularly those that utilize the amlogic-a4 RTC driver.
Is CVE-2025-68754 a network security issue?
CVE-2025-68754 is not classified as a network security issue, but rather a local privilege escalation vulnerability in the kernel.
Can CVE-2025-68754 be exploited remotely?
CVE-2025-68754 requires local access to the system to exploit, making remote exploitation unlikely.