CVE-2026-68238

drm/amdgpu: Release VFCT ACPI table reference

State: Published
Severity: Not scored
Published: Aug 10, 2026
Updated: Oct 30, 2026
Reserved: Jul 30, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: Release VFCT ACPI table reference

amdgpu_acpi_vfct_bios() fetches the VFCT table with acpi_get_table() but never releases it. acpi_get_table() takes a reference on the table (incrementing its validation_count and mapping it on the 0->1 transition); without a paired acpi_put_table() the mapping is leaked on every call, whether or not a matching VBIOS image is found.

Route all exit paths after the table is acquired through a common acpi_put_table(). The VBIOS image is copied out with kmemdup() before the table is released, so it remains valid for the caller.

(cherry picked from commit ca5988682b4cba4cd125a0fa99b2de1239164ae4)

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	d38ceaf99ed015f2a0b9af3499791bd3a3daae21 to before 1c19e02a689661a9687d689dcc5995d3be538262Affected d38ceaf99ed015f2a0b9af3499791bd3a3daae21 to before 1748043b5114ce5ee5ee874d5f821a158d70631cAffected d38ceaf99ed015f2a0b9af3499791bd3a3daae21 to before 50a75929c0c5e8ab29a3ac49dc92489873d9d261Affected d38ceaf99ed015f2a0b9af3499791bd3a3daae21 to before 312278b3091912fa56a6a587609f17dcb33465c2Affected d38ceaf99ed015f2a0b9af3499791bd3a3daae21 to before 9b7de3ee5d2c5ee2a706e5f7ca0126f4fbea4da8Affected d38ceaf99ed015f2a0b9af3499791bd3a3daae21 to before 65bff26617607c1331283232016c0e89088c5b78Affected
LinuxLinux	4.2Affected before 4.2Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.114 through 6.12.Not affected 6.18.42 through 6.18.Not affected 7.1.6 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

d38ceaf99ed015f2a0b9af3499791bd3a3daae21 to before 1c19e02a689661a9687d689dcc5995d3be538262Affected
d38ceaf99ed015f2a0b9af3499791bd3a3daae21 to before 1748043b5114ce5ee5ee874d5f821a158d70631cAffected
d38ceaf99ed015f2a0b9af3499791bd3a3daae21 to before 50a75929c0c5e8ab29a3ac49dc92489873d9d261Affected
d38ceaf99ed015f2a0b9af3499791bd3a3daae21 to before 312278b3091912fa56a6a587609f17dcb33465c2Affected
d38ceaf99ed015f2a0b9af3499791bd3a3daae21 to before 9b7de3ee5d2c5ee2a706e5f7ca0126f4fbea4da8Affected
d38ceaf99ed015f2a0b9af3499791bd3a3daae21 to before 65bff26617607c1331283232016c0e89088c5b78Affected

LinuxLinux

4.2Affected
before 4.2Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.114 through 6.12.*Not affected
6.18.42 through 6.18.*Not affected
7.1.6 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.