SB20260812308 - Improper resource shutdown or release in Linux kernel amd amdgpu driver

Description

This security bulletin contains information about 1 vulnerability.

1) Improper resource shutdown or release (CVE-ID: CVE-2026-68234)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in amdgpu_bo_create_reserved() when handling repeated calls with a non-NULL BO pointer. A local user can trigger repeated resume or firmware buffer reload operations to cause a denial of service.

The issue occurs because repeated calls increase the BO pin count, while teardown only removes a single pin reference, preventing the buffer object from being moved, swapped, or evicted.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/2f390b4c83011452753fd84972f657d2b00a952b
• https://git.kernel.org/stable/c/51eeef1949c11d3dcb5f422a5d9b3f09ebe8a1bc
• https://git.kernel.org/stable/c/9743f60013273987abf415dc47474683d22aaee9
• https://git.kernel.org/stable/c/a2f895f3c852063258d62e9f74b081de07ca95df
• https://git.kernel.org/stable/c/ba7b6444097a73ccd3d3ac9e2be4ebb73d226460