The Linux kernel’s amdgpu driver calls acpi_get_table() to fetch the VFCT ACPI table but never releases it, causing the mapping to remain resident each time the function runs. This results in a memory and resource leak that can accumulate over time and exhaust kernel memory, potentially degrading or denying system services. The vulnerability is a classic uncontrolled resource consumption or memory leak defect.

Affected products are all Linux kernel versions that include the amdgpu driver before the commit that fixes the leak. No specific version range is supplied, so any kernel revision lacking the patch that releases the ACPI table reference is at risk.

The exploit requires repeated execution of the amdgpu_acpi_vfct_bios function, which occurs during GPU initialization or when a custom VBIOS image is loaded. Based on the description, it is inferred that the attacker would need local access to trigger the GPU operations or supply firmware. The CVSS score of 5.5 indicates a medium severity, and the EPSS score of < 1% indicates a very low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog, suggesting limited publicly known attacks. Nonetheless, a determined local adversary could trigger the memory leak repeatedly to exhaust kernel memory, potentially leading to denial‑of‑service conditions. The severity depends on kernel memory usage patterns rather than direct adversarial control.