CVE-2026-68238
Received Received - Intake

AMDGPU VFCT ACPI Table Reference Leak

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Release VFCT ACPI table reference amdgpu_acpi_vfct_bios() fetches the VFCT table with acpi_get_table() but never releases it. acpi_get_table() takes a reference on the table (incrementing its validation_count and mapping it on the 0->1 transition); without a paired acpi_put_table() the mapping is leaked on every call, whether or not a matching VBIOS image is found. Route all exit paths after the table is acquired through a common acpi_put_table(). The VBIOS image is copied out with kmemdup() before the table is released, so it remains valid for the caller. (cherry picked from commit ca5988682b4cba4cd125a0fa99b2de1239164ae4)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-68238
EUVD
EUVD-2026-55339

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the Linux kernel's AMD GPU driver. The issue occurs when the driver fetches the VFCT ACPI table using acpi_get_table() but fails to release it with acpi_put_table(). This causes a memory leak where the table's reference count and mapping are not properly decremented, leading to resource exhaustion over time.

Detection Guidance

This vulnerability is specific to the Linux kernel's AMD GPU driver and does not have network-based detection methods. To detect it, check if your system is running a vulnerable kernel version and inspect the amdgpu driver for the ACPI table reference leak. Use commands like 'uname -a' to check kernel version and 'dmesg | grep amdgpu' to look for driver-related errors.

Impact Analysis

The vulnerability can cause system instability due to memory leaks. Over time, the leaked mappings and references may consume excessive memory, leading to performance degradation, crashes, or denial of service on affected systems running the Linux kernel with AMD GPU drivers.

Mitigation Strategies

Apply the latest kernel update provided by your Linux distribution to patch the amdgpu driver. If an update is not immediately available, consider disabling the AMD GPU driver if not in use or restricting access to affected systems until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-68238. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart