CVE-2026-68180: intel_th: fix MSC output device reference leak
In the Linux kernel, the following vulnerability has been resolved:
intelth: fix MSC output device reference leak
intelthoutputopen() looks up the output device with busfinddevicebydevt(), which returns the device with a reference that must be dropped after use.
commit 95fc36a234da ("intelth: fix device leak on output open()") attempted to drop the reference from intelthoutputrelease(). However, a successful open replaces file->fop with the output driver file operations before returning, so close runs the output driver release callback instead.
For MSC outputs, close runs intelthmscrelease(), which only removes the per-file iterator and does not drop the device reference taken by intelthoutputopen(). Consequently, every successful MSC output open leaks one device reference.
Drop the device reference from intelthmscrelease(), which is the release path actually used for MSC output files. Remove the now-unused intelthoutputrelease() callback from intelthoutputfops.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Patch 95fc36a234da - Compensating control
Apply the kernel fix for the intel_th MSC output device reference leak (commit 95fc36a234da "intel_th: fix device leak on output open()") so the reference taken by bus_find_device_by_devt() is dropped after use in intel_th_output_open()/intel_th_output_release() paths.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68180?
The severity of CVE-2026-68180 is rated at 11.
What type of vulnerability is CVE-2026-68180?
CVE-2026-68180 is a reference leak vulnerability in the Linux kernel's intel_th component.
How do I fix CVE-2026-68180?
To fix CVE-2026-68180, you should update your Linux kernel to the version that includes the commit fixing the reference leak.
Which components are affected by CVE-2026-68180?
CVE-2026-68180 affects the intel_th output device handling in the Linux kernel.
Is CVE-2026-68180 a local or remote vulnerability?
CVE-2026-68180 is considered a local vulnerability since it requires local access to be exploited.