Not yet scoredPublished Aug 10, 2026

CVE-2026-68238drm/amdgpu: Release VFCT ACPI table reference

Updated under an hour ago (Oct 27, 2026, 10:40 AM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Release VFCT ACPI table reference amdgpu_acpi_vfct_bios() fetches the VFCT table with acpi_get_table() but never releases it. acpi_get_table() takes a reference on the table (incrementing its validation_count and mapping it on the 0->1 transition); without a paired acpi_put_table() the mapping is leaked on every call, whether or not a matching VBIOS image is found. Route all exit paths after the table is acquired through a common acpi_put_table(). The VBIOS image is copied out with kmemdup() before the table is released, so it remains valid for the caller. (cherry picked from commit ca5988682b4cba4cd125a0fa99b2de1239164ae4)

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 21, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from d38ceaf99ed015f2a0b9af3499791bd3a3daae21 before 1748043b5114ce5ee5ee874d5f821a158d70631c; from d38ceaf99ed015f2a0b9af3499791bd3a3daae21 before 50a75929c0c5e8ab29a3ac49dc92489873d9d261; from d38ceaf99ed015f2a0b9af3499791bd3a3daae21 before 312278b3091912fa56a6a587609f17dcb33465c2; from d38ceaf99ed015f2a0b9af3499791bd3a3daae21 before 9b7de3ee5d2c5ee2a706e5f7ca0126f4fbea4da8; from d38ceaf99ed015f2a0b9af3499791bd3a3daae21 before 65bff26617607c1331283232016c0e89088c5b78	CNA record

References

References

https://git.kernel.org/stable/c/1748043b5114ce5ee5ee874d5f821a158d70631c
https://git.kernel.org/stable/c/50a75929c0c5e8ab29a3ac49dc92489873d9d261
https://git.kernel.org/stable/c/312278b3091912fa56a6a587609f17dcb33465c2
https://git.kernel.org/stable/c/9b7de3ee5d2c5ee2a706e5f7ca0126f4fbea4da8
https://git.kernel.org/stable/c/65bff26617607c1331283232016c0e89088c5b78

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.