CVE-2026-68238: drm/amdgpu: Release VFCT ACPI table reference
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: Release VFCT ACPI table reference
amdgpuacpivfctbios() fetches the VFCT table with acpigettable() but never releases it. acpigettable() takes a reference on the table (incrementing its validationcount and mapping it on the 0->1 transition); without a paired acpiputtable() the mapping is leaked on every call, whether or not a matching VBIOS image is found.
Route all exit paths after the table is acquired through a common acpiputtable(). The VBIOS image is copied out with kmemdup() before the table is released, so it remains valid for the caller.
(cherry picked from commit ca5988682b4cba4cd125a0fa99b2de1239164ae4)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernel (amdgpu DRM)to a version that resolves this vulnerability.Patch drm/amdgpu: Release VFCT ACPI table reference
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68238?
CVE-2026-68238 is rated with a risk score of 12.
How do I fix CVE-2026-68238?
To fix CVE-2026-68238, ensure you update to the patched version of the Linux kernel that addresses the VFCT ACPI table reference issue.
What systems are impacted by CVE-2026-68238?
CVE-2026-68238 affects systems running the affected versions of the Linux kernel that utilize the amdgpu driver.
What might happen if I don't resolve CVE-2026-68238?
If CVE-2026-68238 is not resolved, it could potentially lead to resource leaks, impacting system stability and performance.
When was CVE-2026-68238 published?
CVE-2026-68238 was published on August 10, 2026.