CVE-2025-68204

CVE-2025-68204

published December 16, 2025

CVSS
—
EPSS
0%
Percentile
10.7
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

pmdomain: arm: scmi: Fix genpd leak on provider registration failure

If of_genpd_add_provider_onecell() fails during probe, the previously

created generic power domains are not removed, leading to a memory leak

and potential kernel crash later in genpd_debug_add().

Add proper error handling to unwind the initialized domains before

returning from probe to ensure all resources are correctly released on

failure.

Example crash trace observed without this fix:

| Unable to handle kernel paging request at virtual address fffffffffffffc70

| CPU: 1 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.18.0-rc1 #405 PREEMPT

| Hardware name: ARM LTD ARM Juno Development Platform/ARM Juno Development Platform

| pstate: 00000005 (nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)

| pc : genpd_debug_add+0x2c/0x160

| lr : genpd_debug_init+0x74/0x98

| Call trace:

| genpd_debug_add+0x2c/0x160 (P)

| genpd_debug_init+0x74/0x98

| do_one_initcall+0xd0/0x2d8

| do_initcall_level+0xa0/0x140

| do_initcalls+0x60/0xa8

| do_basic_setup+0x28/0x40

| kernel_init_freeable+0xe8/0x170

| kernel_init+0x2c/0x140

| ret_from_fork+0x10/0x20

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00210 · 10.7th percentile
Published
2025-12-16T19:15Z
References (8)
EPSS history
Timeline
  • 16 DEC 13:48Z
    pmdomain: arm: scmi: Fix genpd leak on provider registration failure
    cvelistv5