CVE-2026-68238 Overview
CVE-2026-68238 is a memory leak vulnerability in the Linux kernel's AMD GPU driver (drm/amdgpu). The amdgpu_acpi_vfct_bios() function fetches the Video BIOS Configuration Table (VFCT) via acpi_get_table() but never releases it. Each call increments the table's validation_count and maps it on the 0→1 transition without a paired acpi_put_table(), leaking the mapping regardless of whether a matching VBIOS image is found. The fix routes all exit paths through a common acpi_put_table() call, with the VBIOS image copied out using kmemdup() before release so it remains valid for the caller.
Critical Impact
The reference leak in amdgpu_acpi_vfct_bios() causes kernel resource exhaustion over time on systems with AMD GPUs using ACPI-provided VBIOS data.
Affected Products
- Linux kernel (mainline) with drm/amdgpu driver
- Stable kernel branches referenced in kernel.org commits 312278b, 65bff26, and 9b7de3e
- Systems using AMD GPUs that expose VBIOS via ACPI VFCT tables
Discovery Timeline
- 2026-08-10 - CVE-2026-68238 published to NVD
- 2026-08-10 - Last updated in NVD database
Technical Details for CVE-2026-68238
Vulnerability Analysis
The vulnerability resides in amdgpu_acpi_vfct_bios(), a helper in the AMD GPU DRM driver that retrieves VBIOS image data from the ACPI VFCT table. The function calls acpi_get_table() to acquire the table but does not call the paired acpi_put_table() on any exit path. According to the ACPI subsystem contract, acpi_get_table() increments an internal validation_count and establishes a memory mapping on the initial reference. Without the matching release, the mapping persists indefinitely and the reference count grows on each invocation, producing a slow but deterministic kernel memory leak.
Root Cause
The root cause is a missing resource release in cleanup logic. The original implementation returned directly from multiple points inside amdgpu_acpi_vfct_bios() after acquiring the ACPI table reference. Neither the success path (VBIOS image located and copied out) nor the failure paths (table missing signature match, invalid image, or allocation failure) invoke acpi_put_table(). This is a classic reference lifecycle bug affecting resource accounting in the ACPI table manager.
Attack Vector
The leak is triggered through normal driver initialization paths that query the VFCT table. An attacker with the ability to repeatedly invoke code paths reaching amdgpu_acpi_vfct_bios() can gradually consume kernel resources. The practical impact is limited on most systems because the function is not called frequently in typical operation, but repeated module reload cycles or driver rebinds could accelerate exhaustion. No remote or unauthenticated attack surface is directly exposed by this defect.
The fix consolidates cleanup by routing every exit path through a shared acpi_put_table() call. Because kmemdup() copies the VBIOS image into a driver-owned buffer before the ACPI table is released, no dangling pointers are introduced. See the Kernel Git Commit 312278b, Kernel Git Commit 65bff26, and Kernel Git Commit 9b7de3e for the full patches.
Detection Methods for CVE-2026-68238
Indicators of Compromise
- Gradual increase in kernel memory usage on systems with AMD GPUs using ACPI VFCT-provided VBIOS
- Elevated validation_count for the VFCT entry visible through ACPI debug interfaces
- Repeated amdgpu module load/unload cycles correlated with unreleased ACPI table mappings
Detection Strategies
- Audit kernel version and applied patches against the fixing commits 312278b, 65bff26, and 9b7de3e
- Monitor /proc/meminfo and slab statistics for slow, non-recovering kernel memory growth on AMD GPU hosts
- Review kernel logs for anomalies during amdgpu initialization on ACPI-enabled platforms
Monitoring Recommendations
- Track kernel memory trends on Linux workloads running AMD GPU drivers over extended uptime windows
- Alert on unexpected amdgpu module reloads that could amplify the leak
- Include kernel package versions in configuration management baselines to detect drift from patched releases
How to Mitigate CVE-2026-68238
Immediate Actions Required
- Update to a Linux kernel release that includes commits 312278b3091912fa, 65bff266176607c13, or 9b7de3ee5d2c5ee2a for the appropriate stable branch
- Inventory hosts running the amdgpu driver on ACPI platforms and prioritize those with long uptime
- Apply distribution vendor kernel updates as they become available
Patch Information
The fix is a cherry-pick of upstream commit ca5988682b4cba4cd125a0fa99b2de1239164ae4. It adds a paired acpi_put_table() call and routes all exit paths through a common cleanup block. The VBIOS image is duplicated with kmemdup() before the ACPI table reference is released, preserving caller semantics. Patches for stable branches are available at the Kernel Git Commit 312278b, Kernel Git Commit 65bff26, and Kernel Git Commit 9b7de3e references.
Workarounds
- Reboot long-running AMD GPU systems periodically to reset leaked ACPI table mappings until the patch is deployed
- Avoid unnecessary amdgpu module reloads on production hosts to limit accumulation
- Restrict local privileged access that could induce repeated driver initialization cycles
# Verify current kernel version and check for applied fix
uname -r
# Query package manager for kernel updates (example: Debian/Ubuntu)
apt list --upgradable | grep linux-image
# Query package manager for kernel updates (example: RHEL/Fedora)
dnf check-update kernel
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
