CVE-2026-45947: Linux Kernel Memory Leak Vulnerability

CVE-2026-45947 Overview

CVE-2026-45947 is a memory leak vulnerability in the Linux kernel's AMD GPU driver. The flaw resides in the amdgpu_acpi_enumerate_xcc() function within the drm/amdgpu subsystem. When amdgpu_acpi_dev_init() returns -ENOMEM, the function exits without releasing the previously allocated xcc_info structure. Each failed initialization attempt leaks kernel memory associated with the ACPI XCC enumeration path.

The issue was identified through a prototype static analysis tool and subsequent code review. The kernel maintainers have merged fixes across multiple stable branches to ensure xcc_info is properly freed in all error paths.

Critical Impact
Repeated triggering of the error path can exhaust kernel memory on systems using affected AMD GPU hardware, potentially leading to denial of service.

Affected Products

Linux kernel containing the drm/amdgpu driver with ACPI XCC enumeration support
Systems using AMD GPU hardware that invokes amdgpu_acpi_enumerate_xcc()
Distributions tracking mainline and stable Linux kernel branches prior to the referenced fix commits

Discovery Timeline

2026-05-27 - CVE-2026-45947 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-45947

Vulnerability Analysis

The vulnerability is a kernel memory leak [CWE-401] in the AMD GPU Direct Rendering Manager (DRM) driver. The amdgpu_acpi_enumerate_xcc() function allocates an xcc_info structure during ACPI enumeration of XCC (cross-chiplet controller) devices. The function then calls amdgpu_acpi_dev_init() to complete device initialization.

When amdgpu_acpi_dev_init() fails with -ENOMEM, the original implementation returns immediately. The allocated xcc_info is never freed, leaving an orphaned allocation in kernel memory. The leak persists for the lifetime of the kernel and accumulates with each failed enumeration attempt.

Root Cause

The root cause is missing cleanup logic in an error path. The function lacks a goto-based unwind sequence or explicit kfree(xcc_info) call before returning from the -ENOMEM branch. The fix introduces proper cleanup so that xcc_info is released whenever subsequent initialization fails.

Attack Vector

Triggering the leak requires conditions that cause amdgpu_acpi_dev_init() to return -ENOMEM. This typically occurs under memory pressure on systems with AMD GPUs that expose XCC ACPI entries. A local actor cannot directly invoke the kernel function but can influence memory pressure to increase the likelihood of failure. The practical impact is gradual kernel memory exhaustion rather than direct code execution or privilege escalation.

The vulnerability was compile-tested only by the patch author. See the Linux Kernel Commit 18a7bbd and related stable backports for the corrective changes.

Detection Methods for CVE-2026-45947

Indicators of Compromise

Sustained growth in kernel slab allocations associated with the amdgpu driver visible in /proc/slabinfo
Repeated -ENOMEM log entries originating from the amdgpu ACPI initialization path in dmesg
Gradual reduction of MemAvailable reported in /proc/meminfo on systems with AMD GPU hardware

Detection Strategies

Compare the running kernel version against the fixed commits referenced in the kernel.org stable tree
Use kmemleak with CONFIG_DEBUG_KMEMLEAK enabled on test systems to confirm unreleased xcc_info allocations
Audit kernel package inventories across the fleet to identify hosts running unpatched amdgpu driver builds

Monitoring Recommendations

Track long-term kernel memory consumption trends on AMD GPU hosts and alert on abnormal growth
Monitor kernel ring buffer messages for amdgpu initialization errors during boot and runtime
Include kernel version inventory in standard vulnerability management scans of Linux servers and workstations

How to Mitigate CVE-2026-45947

Immediate Actions Required

Identify all Linux hosts running affected amdgpu driver versions, especially systems with AMD Instinct or other XCC-capable GPUs
Apply the latest stable kernel update from your distribution that incorporates the upstream fix
Reboot affected systems after kernel upgrade to load the patched driver

Patch Information

The issue has been resolved in the upstream Linux kernel through multiple stable backports. The corrective commits ensure xcc_info is freed in the -ENOMEM error path. Reference the following kernel.org commits:

Workarounds

Blacklist the amdgpu module on systems that do not require AMD GPU functionality until the patched kernel is deployed
Schedule periodic reboots on long-running hosts to reset kernel memory state while a permanent fix is pending
Monitor and constrain workloads that induce memory pressure on systems with affected AMD GPU hardware

bash

# Verify the running kernel version and check for the fix
uname -r

# On Debian/Ubuntu, update to the latest kernel package
sudo apt update && sudo apt install --only-upgrade linux-image-generic

# On RHEL/Fedora, update the kernel package
sudo dnf update kernel

# Confirm the amdgpu module is loaded and inspect dmesg for errors
lsmod | grep amdgpu
dmesg | grep -i amdgpu