SB20260812443 - Missing Release of Resource after Effective Lifetime in Linux kernel amd amdgpu driver

Description

This security bulletin contains information about 1 vulnerability.

1) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-68102)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a resource leak in the amdgpu aperture mapping handling in amdgpu_ttm_fini() and amdgpu_device_unmap_mmio() when unloading and reloading the driver on connected_to_cpu hardware. A local user can trigger driver unload and reload to cause a denial of service.

The issue can leave an orphaned x86 PAT interval tree entry, and a subsequent write-combining versus write-back mapping conflict can cause GPU discovery to fail.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/6405c4e75b3bcf0e72bd7a0ff5f1ed0c475e23aa
• https://git.kernel.org/stable/c/67bc3647e418e23dc0d17604bdba634a73de809f
• https://git.kernel.org/stable/c/a343d028ad6c174da8dc6af560c51e6d140a6727
• https://git.kernel.org/stable/c/ea772a440d56b285f4d491affac50ecd41f6b402
• https://git.kernel.org/stable/c/f5988b5c300a32ff751724ffd33d5a8d5873e4a7