In the Linux kernel, the following vulnerability has been resolved:
most: usb: hdmprobe: Fix calling putdevice() before device initialization
The early error path in hdmprobe() can jump to errfreemdev before &mdev->dev has been initialized with deviceinitialize(). Calling putdevice(&mdev->dev) there triggers a device core WARN and ends up invoking krefput(&kobj->kref, kobject_release) on an uninitialized kobject.
In this path the private struct was only kmalloc'ed and the intended release is effectively kfree(mdev) anyway, so free it directly instead of calling put_device() on an uninitialized device.
This removes the WARNING and fixes the pre-initialization error path.
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68249.json"
}