CVE-2026-98779

About vulnerability

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: fix ACP MFD device leak on init failure

acp_hw_init() registers ACP child devices with mfd_add_devices() before attaching them to the ACP power domain and initializing the hardware.

If attaching a child to the power domain fails, or if the ACP reset or clock enable operation times out, the failure path frees only the source cell, resource, and platform-data allocations. The child platform devices already registered by mfd_add_devices() remain registered and are never released.

Remove the children from the power domain and unregister the MFD devices on failures that occur after mfd_add_devices() succeeds. Keep mfd_add_devices() failures on the existing cleanup path since the MFD core already rolls back partially registered children itself.

The issue was identified by a static analysis tool I developed and confirmed by manual review.

(cherry picked from commit 63da68d6a2279ec945581c990c5a59a5ae8b5560)

Affected product:

AlmaLinux 9.2 ESU , Amazon Linux 2 ELS , CentOS 8.4 ELS , CentOS 8.5 ELS , CentOS Stream 8 ELS , Debian 10 ELS , Debian 11 ELS , Oracle Linux 7 ELS , TuxCare 9.6 ESU , TuxCare 9.8 ESU , Ubuntu 16.04 ELS , Ubuntu 18.04 ELS , Ubuntu 20.04 ELS

Affected packages:

linux @ 5.10.259 (+12 more)