LiveActive security incident?Get immediate response
CVE Record

CVE-2025-68754: rtc: amlogic-a4: fix double free caused by devm

In the Linux kernel, the following vulnerability has been resolved: rtc: amlogic-a4: fix double free caused by devm The clock obtained via devm_clk_get_enabled() is automatically managed by devres and will be disabled and freed on driver detach. Manually calling clk_disable_unprepare() in error path and remove function causes double free. Remove the redundant clk_disable_unprepare() calls from the probe error path and aml_rtc_remove(), allowing the devm framework to automatically manage the clock lifecycle.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2025-68754 is a Linux kernel bug in the Amlogic A4 real-time clock driver. A clock resource was automatically managed but also manually released, creating a double free during error handling or driver removal. The source bundle provides no severity score.

Executive priority

Treat as targeted kernel maintenance unless Amlogic A4-based systems are important in your environment. There is no sourced evidence of exploitation or severity, but kernel double-free bugs deserve prompt vendor-guided patching when the affected driver is present.

Technical view

The rtc: amlogic-a4 driver obtains a clock with devm_clk_get_enabled(), which devres disables and frees on detach. Redundant clk_disable_unprepare() calls in probe error handling and aml_rtc_remove() could release the same resource twice. The referenced stable commits remove those calls.

Likely exposure

Exposure appears limited to Linux systems with affected kernel code and the Amlogic A4 RTC driver present or in use. The bundle lists Linux kernel versions and commit ranges but provides no CPEs or distribution-specific package names.

Exploitation context

The bundle does not report active exploitation, and KEV status is false. No public exploit details are provided. Practical impact depends on whether the affected driver can be reached through normal device lifecycle events on deployed systems.

Researcher notes

Evidence is strongest on root cause and fix direction. The CVE text identifies devm-managed clock lifecycle misuse and three stable kernel commits. Missing data includes CVSS, CWE, exploitability analysis, and distribution-specific affected package mappings.

Mitigation direction

  • Apply a kernel update that includes the referenced stable fixes.
  • Check Linux distribution or device vendor advisories for backported fixes.
  • Prioritize systems using Amlogic A4 hardware or this RTC driver.
  • Avoid inventing local workarounds; follow vendor kernel guidance.

Validation and detection

  • Inventory kernel versions and enabled RTC drivers on relevant assets.
  • Confirm whether the amlogic-a4 RTC driver is built, loaded, or deployed.
  • Verify the referenced fix commits or equivalent backports are present.
  • Track distribution package advisories for CVE-2025-68754 coverage.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-68754 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
4Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxc89ac9182ee297597f1c6971045382bae19c3f9d, c89ac9182ee297597f1c6971045382bae19c3f9d, c89ac9182ee297597f1c6971045382bae19c3f9dunaffected
LinuxLinux6.13, 0, 6.17.13, 6.18.2, 6.19affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.