SB20260812294 - Improper resource shutdown or release in Linux kernel amd amdgpu driver

Description

This security bulletin contains information about 1 vulnerability.

1) Improper resource shutdown or release (CVE-ID: CVE-2026-68238)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in amdgpu_acpi_vfct_bios() when fetching and processing the ACPI VFCT table. A local user can trigger repeated calls to the vulnerable function to cause a denial of service.

The issue leaks an ACPI table mapping because the reference obtained with acpi_get_table() is not released on exit paths after the table is acquired.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/312278b3091912fa56a6a587609f17dcb33465c2
• https://git.kernel.org/stable/c/65bff26617607c1331283232016c0e89088c5b78
• https://git.kernel.org/stable/c/9b7de3ee5d2c5ee2a706e5f7ca0126f4fbea4da8