CVE-2026-68238 drm/amdgpu: Release VFCT ACPI table reference
A memory leak in the Linux kernel amdgpu driver allows local attackers to exhaust system resources, causing denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-68238?
CVE-2026-68238 is a memory corruption vulnerability in Linux, published on 10 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: Release VFCT ACPI table reference
amdgpu_acpi_vfct_bios() fetches the VFCT table with acpi_get_table() but never releases it. acpi_get_table() takes a reference on the table (incrementing its validation_count and mapping it on the 0->1 transition); without a paired acpi_put_table() the mapping is leaked on every call, whether or not a matching VBIOS image is found.
Route all exit paths after the table is acquired through a common acpi_put_table(). The VBIOS image is copied out with kmemdup() before the table is released, so it remains valid for the caller.
(cherry picked from commit ca5988682b4cba4cd125a0fa99b2de1239164ae4)
Which versions are affected by CVE-2026-68238?
How do I fix CVE-2026-68238?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-68238 being exploited?
There is no known exploitation of CVE-2026-68238 in the wild and no public exploit code.
Sources
Also known as AZL-95235, BELL-CVE-2026-68238, DEBIAN-CVE-2026-68238, GHSA-cp54-xgp7-w9qr, UBUNTU-CVE-2026-68238.