CVE-2026-98779

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: fix ACP MFD device leak on init failure

acp_hw_init() registers ACP child devices with mfd_add_devices() before

attaching them to the ACP power domain and initializing the hardware.

If attaching a child to the power domain fails, or if the ACP reset or

clock enable operation times out, the failure path frees only the

source cell, resource, and platform-data allocations. The child

platform devices already registered by mfd_add_devices() remain

registered and are never released.

Remove the children from the power domain and unregister the MFD

devices on failures that occur after mfd_add_devices() succeeds. Keep

mfd_add_devices() failures on the existing cleanup path since the MFD

core already rolls back partially registered children itself.

The issue was identified by a static analysis tool I developed and

confirmed by manual review.

(cherry picked from commit 63da68d6a2279ec945581c990c5a59a5ae8b5560)

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References