---
id: CVE-2026-68238
title: 'drm/amdgpu: Release VFCT ACPI table reference'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  drm/amdgpu: Release VFCT ACPI table reference

  amdgpu_acpi_vfct_bios() fetches the VFCT table with acpi_get_table()
  but never releases it. acpi_get_table() takes a refe…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= d38ceaf99ed015f2a0b9af3499791bd3a3daae21 <
    1748043b5114ce5ee5ee874d5f821a158d70631c
  - >-
    Linux >= d38ceaf99ed015f2a0b9af3499791bd3a3daae21 <
    50a75929c0c5e8ab29a3ac49dc92489873d9d261
  - >-
    Linux >= d38ceaf99ed015f2a0b9af3499791bd3a3daae21 <
    312278b3091912fa56a6a587609f17dcb33465c2
  - >-
    Linux >= d38ceaf99ed015f2a0b9af3499791bd3a3daae21 <
    9b7de3ee5d2c5ee2a706e5f7ca0126f4fbea4da8
  - >-
    Linux >= d38ceaf99ed015f2a0b9af3499791bd3a3daae21 <
    65bff26617607c1331283232016c0e89088c5b78
  - Linux 4.2
published: '2026-08-10'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T12:43:35.374Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-68238'
references:
  - url: 'https://git.kernel.org/stable/c/1748043b5114ce5ee5ee874d5f821a158d70631c'
  - url: 'https://git.kernel.org/stable/c/50a75929c0c5e8ab29a3ac49dc92489873d9d261'
  - url: 'https://git.kernel.org/stable/c/312278b3091912fa56a6a587609f17dcb33465c2'
  - url: 'https://git.kernel.org/stable/c/9b7de3ee5d2c5ee2a706e5f7ca0126f4fbea4da8'
  - url: 'https://git.kernel.org/stable/c/65bff26617607c1331283232016c0e89088c5b78'
tags:
  - cve.org
epss: 0.00166
epssPercentile: 0.05498
ingestedAt: '2026-10-21T12:48:53.603Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: Release VFCT ACPI table reference

amdgpu_acpi_vfct_bios() fetches the VFCT table with acpi_get_table()
but never releases it. acpi_get_table() takes a reference on the
table (incrementing its validation_count and mapping it on the 0->1
transition); without a paired acpi_put_table() the mapping is leaked
on every call, whether or not a matching VBIOS image is found.

Route all exit paths after the table is acquired through a common
acpi_put_table(). The VBIOS image is copied out with kmemdup() before
the table is released, so it remains valid for the caller.

(cherry picked from commit ca5988682b4cba4cd125a0fa99b2de1239164ae4)

## Affected

- `Linux >= d38ceaf99ed015f2a0b9af3499791bd3a3daae21 < 1748043b5114ce5ee5ee874d5f821a158d70631c`
- `Linux >= d38ceaf99ed015f2a0b9af3499791bd3a3daae21 < 50a75929c0c5e8ab29a3ac49dc92489873d9d261`
- `Linux >= d38ceaf99ed015f2a0b9af3499791bd3a3daae21 < 312278b3091912fa56a6a587609f17dcb33465c2`
- `Linux >= d38ceaf99ed015f2a0b9af3499791bd3a3daae21 < 9b7de3ee5d2c5ee2a706e5f7ca0126f4fbea4da8`
- `Linux >= d38ceaf99ed015f2a0b9af3499791bd3a3daae21 < 65bff26617607c1331283232016c0e89088c5b78`
- `Linux 4.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.