Unrated severityNVD Advisory· Published May 27, 2026· Updated May 27, 2026

CVE-2026-45947

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc()

In amdgpu_acpi_enumerate_xcc(), if amdgpu_acpi_dev_init() returns -ENOMEM, the function returns directly without releasing the allocated xcc_info, resulting in a memory leak.

Fix this by ensuring that xcc_info is properly freed in the error paths.

Compile tested only. Issue found using a prototype static analysis tool and code review.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A memory leak in amdgpu_acpi_enumerate_xcc() in the Linux kernel enables local resource exhaustion.

Vulnerability

In the Linux kernel, a memory leak exists in the amdgpu_acpi_enumerate_xcc() function within the drm/amdgpu driver. When amdgpu_acpi_dev_init() returns -ENOMEM, the function returns directly without freeing the previously allocated xcc_info buffer, causing the memory to leak. The issue affects stable kernel versions as indicated by the patch commit [1].

Exploitation

An attacker with local access to the system can trigger the vulnerability by causing memory allocation failures (e.g., by exhausting system memory) that lead amdgpu_acpi_dev_init() to return -ENOMEM. The vulnerable code path is reachable without special privileges, but requires the AMDGPU driver to be loaded and the system to have appropriate ACPI support.

Impact

Successful exploitation results in a kernel memory leak, which can lead to resource exhaustion and denial-of-service (DoS) conditions. The system may become unstable or unresponsive due to depleted kernel memory. No privilege escalation or data disclosure is possible.

Mitigation

The fix is available in the kernel stable commit 7e4b612fe7a960d610c20260c9ee220bddd1b215 [1]. Upgrading to a kernel version containing this commit resolves the vulnerability. No workaround or KEV listing is available.

References

Making sure you're not a bot!

AI Insight generated on May 27, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

Ubuntu/Linux Kernelllm-fuzzy

Patches

c9be63d56578

drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc()

https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitZilin GuanJan 29, 2026Fixed in 7.0via kernel-cna

commit

2 files changed · +6 −4

drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c+3 −2 modified

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
index c126d1bf2bc836..02d5abf9df2bae 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
@@ -1186,8 +1186,10 @@ int amdgpu_acpi_enumerate_xcc(void)
 		if (!dev_info)
 			ret = amdgpu_acpi_dev_init(&dev_info, xcc_info, sbdf);
 
-		if (ret == -ENOMEM)
+		if (ret == -ENOMEM) {
+			kfree(xcc_info);
 			return ret;
+		}
 
 		if (!dev_info) {
 			kfree(xcc_info);
-- 
cgit 1.3-korg

drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c+3 −2 modified

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
index c126d1bf2bc836..02d5abf9df2bae 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
@@ -1186,8 +1186,10 @@ int amdgpu_acpi_enumerate_xcc(void)
 		if (!dev_info)
 			ret = amdgpu_acpi_dev_init(&dev_info, xcc_info, sbdf);
 
-		if (ret == -ENOMEM)
+		if (ret == -ENOMEM) {
+			kfree(xcc_info);
 			return ret;
+		}
 
 		if (!dev_info) {
 			kfree(xcc_info);
-- 
cgit 1.3-korg

7e4b612fe7a9

drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc()

https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitZilin GuanJan 29, 2026Fixed in 6.19.4via kernel-cna

commit

2 files changed · +6 −4

drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c+3 −2 modified

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
index d31460a9e95829..7c9d8a6d0bfdb9 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
@@ -1135,8 +1135,10 @@ static int amdgpu_acpi_enumerate_xcc(void)
 		if (!dev_info)
 			ret = amdgpu_acpi_dev_init(&dev_info, xcc_info, sbdf);
 
-		if (ret == -ENOMEM)
+		if (ret == -ENOMEM) {
+			kfree(xcc_info);
 			return ret;
+		}
 
 		if (!dev_info) {
 			kfree(xcc_info);
-- 
cgit 1.3-korg

drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c+3 −2 modified

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
index d31460a9e95829..7c9d8a6d0bfdb9 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
@@ -1135,8 +1135,10 @@ static int amdgpu_acpi_enumerate_xcc(void)
 		if (!dev_info)
 			ret = amdgpu_acpi_dev_init(&dev_info, xcc_info, sbdf);
 
-		if (ret == -ENOMEM)
+		if (ret == -ENOMEM) {
+			kfree(xcc_info);
 			return ret;
+		}
 
 		if (!dev_info) {
 			kfree(xcc_info);
-- 
cgit 1.3-korg

e87c73a80a12

drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc()

https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitZilin GuanJan 29, 2026Fixed in 6.6.128via kernel-cna

commit

2 files changed · +6 −4

drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c+3 −2 modified

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
index 8b2f2b921d9de3..7730e56444934f 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
@@ -1128,8 +1128,10 @@ static int amdgpu_acpi_enumerate_xcc(void)
 		if (!dev_info)
 			ret = amdgpu_acpi_dev_init(&dev_info, xcc_info, bdf);
 
-		if (ret == -ENOMEM)
+		if (ret == -ENOMEM) {
+			kfree(xcc_info);
 			return ret;
+		}
 
 		if (!dev_info) {
 			kfree(xcc_info);
-- 
cgit 1.3-korg

drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c+3 −2 modified

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
index 8b2f2b921d9de3..7730e56444934f 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
@@ -1128,8 +1128,10 @@ static int amdgpu_acpi_enumerate_xcc(void)
 		if (!dev_info)
 			ret = amdgpu_acpi_dev_init(&dev_info, xcc_info, bdf);
 
-		if (ret == -ENOMEM)
+		if (ret == -ENOMEM) {
+			kfree(xcc_info);
 			return ret;
+		}
 
 		if (!dev_info) {
 			kfree(xcc_info);
-- 
cgit 1.3-korg

18a7bbd11f17

drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc()

https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitZilin GuanJan 29, 2026Fixed in 6.12.75via kernel-cna

commit

2 files changed · +6 −4

drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c+3 −2 modified

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
index bebfbc1497d8e0..d4848041817562 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
@@ -1132,8 +1132,10 @@ static int amdgpu_acpi_enumerate_xcc(void)
 		if (!dev_info)
 			ret = amdgpu_acpi_dev_init(&dev_info, xcc_info, sbdf);
 
-		if (ret == -ENOMEM)
+		if (ret == -ENOMEM) {
+			kfree(xcc_info);
 			return ret;
+		}
 
 		if (!dev_info) {
 			kfree(xcc_info);
-- 
cgit 1.3-korg

drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c+3 −2 modified

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
index bebfbc1497d8e0..d4848041817562 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
@@ -1132,8 +1132,10 @@ static int amdgpu_acpi_enumerate_xcc(void)
 		if (!dev_info)
 			ret = amdgpu_acpi_dev_init(&dev_info, xcc_info, sbdf);
 
-		if (ret == -ENOMEM)
+		if (ret == -ENOMEM) {
+			kfree(xcc_info);
 			return ret;
+		}
 
 		if (!dev_info) {
 			kfree(xcc_info);
-- 
cgit 1.3-korg

d1370ef2ecf7

drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc()

https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.gitZilin GuanJan 29, 2026Fixed in 6.18.14via kernel-cna

commit

2 files changed · +6 −4

drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c+3 −2 modified

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
index 6c62e27b980023..67db986eda3f64 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
@@ -1136,8 +1136,10 @@ static int amdgpu_acpi_enumerate_xcc(void)
 		if (!dev_info)
 			ret = amdgpu_acpi_dev_init(&dev_info, xcc_info, sbdf);
 
-		if (ret == -ENOMEM)
+		if (ret == -ENOMEM) {
+			kfree(xcc_info);
 			return ret;
+		}
 
 		if (!dev_info) {
 			kfree(xcc_info);
-- 
cgit 1.3-korg

drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c+3 −2 modified

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
index 6c62e27b980023..67db986eda3f64 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
@@ -1136,8 +1136,10 @@ static int amdgpu_acpi_enumerate_xcc(void)
 		if (!dev_info)
 			ret = amdgpu_acpi_dev_init(&dev_info, xcc_info, sbdf);
 
-		if (ret == -ENOMEM)
+		if (ret == -ENOMEM) {
+			kfree(xcc_info);
 			return ret;
+		}
 
 		if (!dev_info) {
 			kfree(xcc_info);
-- 
cgit 1.3-korg

d1370ef2ecf7

drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc()

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.gitZilin GuanJan 29, 2026via nvd-ref

commit

2 files changed · +6 −4

drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c+3 −2 modified

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
index 6c62e27b980023..67db986eda3f64 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
@@ -1136,8 +1136,10 @@ static int amdgpu_acpi_enumerate_xcc(void)
 		if (!dev_info)
 			ret = amdgpu_acpi_dev_init(&dev_info, xcc_info, sbdf);
 
-		if (ret == -ENOMEM)
+		if (ret == -ENOMEM) {
+			kfree(xcc_info);
 			return ret;
+		}
 
 		if (!dev_info) {
 			kfree(xcc_info);
-- 
cgit 1.3-korg

drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c+3 −2 modified

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
index 6c62e27b980023..67db986eda3f64 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
@@ -1136,8 +1136,10 @@ static int amdgpu_acpi_enumerate_xcc(void)
 		if (!dev_info)
 			ret = amdgpu_acpi_dev_init(&dev_info, xcc_info, sbdf);
 
-		if (ret == -ENOMEM)
+		if (ret == -ENOMEM) {
+			kfree(xcc_info);
 			return ret;
+		}
 
 		if (!dev_info) {
 			kfree(xcc_info);
-- 
cgit 1.3-korg

e87c73a80a12

drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc()

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.gitZilin GuanJan 29, 2026via nvd-ref

commit

2 files changed · +6 −4

drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c+3 −2 modified

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
index 8b2f2b921d9de3..7730e56444934f 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
@@ -1128,8 +1128,10 @@ static int amdgpu_acpi_enumerate_xcc(void)
 		if (!dev_info)
 			ret = amdgpu_acpi_dev_init(&dev_info, xcc_info, bdf);
 
-		if (ret == -ENOMEM)
+		if (ret == -ENOMEM) {
+			kfree(xcc_info);
 			return ret;
+		}
 
 		if (!dev_info) {
 			kfree(xcc_info);
-- 
cgit 1.3-korg

drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c+3 −2 modified

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
index 8b2f2b921d9de3..7730e56444934f 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
@@ -1128,8 +1128,10 @@ static int amdgpu_acpi_enumerate_xcc(void)
 		if (!dev_info)
 			ret = amdgpu_acpi_dev_init(&dev_info, xcc_info, bdf);
 
-		if (ret == -ENOMEM)
+		if (ret == -ENOMEM) {
+			kfree(xcc_info);
 			return ret;
+		}
 
 		if (!dev_info) {
 			kfree(xcc_info);
-- 
cgit 1.3-korg

18a7bbd11f17

drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc()

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.gitZilin GuanJan 29, 2026via nvd-ref

commit

2 files changed · +6 −4

drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c+3 −2 modified

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
index bebfbc1497d8e0..d4848041817562 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
@@ -1132,8 +1132,10 @@ static int amdgpu_acpi_enumerate_xcc(void)
 		if (!dev_info)
 			ret = amdgpu_acpi_dev_init(&dev_info, xcc_info, sbdf);
 
-		if (ret == -ENOMEM)
+		if (ret == -ENOMEM) {
+			kfree(xcc_info);
 			return ret;
+		}
 
 		if (!dev_info) {
 			kfree(xcc_info);
-- 
cgit 1.3-korg

drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c+3 −2 modified

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
index bebfbc1497d8e0..d4848041817562 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
@@ -1132,8 +1132,10 @@ static int amdgpu_acpi_enumerate_xcc(void)
 		if (!dev_info)
 			ret = amdgpu_acpi_dev_init(&dev_info, xcc_info, sbdf);
 
-		if (ret == -ENOMEM)
+		if (ret == -ENOMEM) {
+			kfree(xcc_info);
 			return ret;
+		}
 
 		if (!dev_info) {
 			kfree(xcc_info);
-- 
cgit 1.3-korg

7e4b612fe7a9

drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc()

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.gitZilin GuanJan 29, 2026via nvd-ref

commit

2 files changed · +6 −4

drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c+3 −2 modified

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
index d31460a9e95829..7c9d8a6d0bfdb9 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
@@ -1135,8 +1135,10 @@ static int amdgpu_acpi_enumerate_xcc(void)
 		if (!dev_info)
 			ret = amdgpu_acpi_dev_init(&dev_info, xcc_info, sbdf);
 
-		if (ret == -ENOMEM)
+		if (ret == -ENOMEM) {
+			kfree(xcc_info);
 			return ret;
+		}
 
 		if (!dev_info) {
 			kfree(xcc_info);
-- 
cgit 1.3-korg

drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c+3 −2 modified

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
index d31460a9e95829..7c9d8a6d0bfdb9 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
@@ -1135,8 +1135,10 @@ static int amdgpu_acpi_enumerate_xcc(void)
 		if (!dev_info)
 			ret = amdgpu_acpi_dev_init(&dev_info, xcc_info, sbdf);
 
-		if (ret == -ENOMEM)
+		if (ret == -ENOMEM) {
+			kfree(xcc_info);
 			return ret;
+		}
 
 		if (!dev_info) {
 			kfree(xcc_info);
-- 
cgit 1.3-korg

c9be63d56578

drm/amdgpu: Fix memory leak in amdgpu_acpi_enumerate_xcc()

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.gitZilin GuanJan 29, 2026via nvd-ref

commit

2 files changed · +6 −4

drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c+3 −2 modified

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
index c126d1bf2bc836..02d5abf9df2bae 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
@@ -1186,8 +1186,10 @@ int amdgpu_acpi_enumerate_xcc(void)
 		if (!dev_info)
 			ret = amdgpu_acpi_dev_init(&dev_info, xcc_info, sbdf);
 
-		if (ret == -ENOMEM)
+		if (ret == -ENOMEM) {
+			kfree(xcc_info);
 			return ret;
+		}
 
 		if (!dev_info) {
 			kfree(xcc_info);
-- 
cgit 1.3-korg

drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c+3 −2 modified

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
index c126d1bf2bc836..02d5abf9df2bae 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c
@@ -1186,8 +1186,10 @@ int amdgpu_acpi_enumerate_xcc(void)
 		if (!dev_info)
 			ret = amdgpu_acpi_dev_init(&dev_info, xcc_info, sbdf);
 
-		if (ret == -ENOMEM)
+		if (ret == -ENOMEM) {
+			kfree(xcc_info);
 			return ret;
+		}
 
 		if (!dev_info) {
 			kfree(xcc_info);
-- 
cgit 1.3-korg

Vulnerability mechanics

Root cause

"Missing kfree(xcc_info) before early return on -ENOMEM from amdgpu_acpi_dev_init() causes a memory leak."

Attack vector

An attacker would need to trigger an out-of-memory condition during ACPI device initialization so that amdgpu_acpi_dev_init() returns -ENOMEM. This occurs in the amdgpu_acpi_enumerate_xcc() function in drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c [patch_id=2661095]. The function allocates xcc_info via kzalloc earlier in the same function, and when the -ENOMEM path is taken the pointer is lost without being freed. No special privileges or network access are required; the bug is reachable during normal kernel module initialization on AMD GPU hardware.

Affected code

The vulnerable function is `amdgpu_acpi_enumerate_xcc()` in `drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c` [patch_id=2661095]. The error path at the `if (ret == -ENOMEM)` check (around line 1132-1136 depending on the kernel version) returned without freeing the previously allocated `xcc_info` pointer.

What the fix does

The patch wraps the existing `if (ret == -ENOMEM) return ret;` block with braces and adds `kfree(xcc_info);` before the return [patch_id=2661095]. This ensures that the memory allocated for xcc_info is released when amdgpu_acpi_dev_init() fails with -ENOMEM, matching the existing cleanup pattern already used in the subsequent `if (!dev_info)` error path. The fix is identical across all backport variants (e.g. [patch_id=2661090], [patch_id=2661092]).

Preconditions

configThe kernel must be built with CONFIG_DRM_AMDGPU and run on AMD GPU hardware that triggers ACPI XCC enumeration.
inputThe system must experience an out-of-memory condition such that amdgpu_acpi_dev_init() returns -ENOMEM.

Generated on May 27, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000