The Linux kernel’s amdgpu driver calls acpi_get_table() to fetch the VFCT ACPI table but never releases it, causing the mapping to remain resident each time the function runs. This results in a memory and resource leak that can accumulate over time and exhaust kernel memory, potentially degrading or denying system services. The vulnerability is a classic uncontrolled resource consumption or memory leak defect.

Affected products are all Linux kernel versions that include the amdgpu driver before the commit that fixes the leak. No specific version range is supplied, so any kernel revision lacking the patch that releases the ACPI table reference is at risk.

The exploit requires repeated execution of the amdgpu_acpi_vfct_bios function, which occurs during GPU initialization or when a custom VBIOS image is loaded. The attacker is therefore likely a local user with the ability to initiate GPU operations or supply firmware. The absence of an EPSS score and KEV listing implies limited publicly known targeting, but the memory leak could still be leveraged for denial of service if the system continually loads VFCT tables or is subjected to chronic GPU activity. The severity is largely determined by the kernel's memory usage patterns rather than by direct adversary control.