CVE-2026-68180: intel_th: fix MSC output device reference leak

Published Aug 10, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

intelth: fix MSC output device reference leak

intelthoutputopen() looks up the output device with busfinddevicebydevt(), which returns the device with a reference that must be dropped after use.

commit 95fc36a234da ("intelth: fix device leak on output open()") attempted to drop the reference from intelthoutputrelease(). However, a successful open replaces file->fop with the output driver file operations before returning, so close runs the output driver release callback instead.

For MSC outputs, close runs intelthmscrelease(), which only removes the per-file iterator and does not drop the device reference taken by intelthoutputopen(). Consequently, every successful MSC output open leaks one device reference.

Drop the device reference from intelthmscrelease(), which is the release path actually used for MSC output files. Remove the now-unused intelthoutputrelease() callback from intelthoutputfops.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade Linux kernel to a version that resolves this vulnerability.

    Patch 95fc36a234da
  2. Compensating control

    Apply the kernel fix for the intel_th MSC output device reference leak (commit 95fc36a234da "intel_th: fix device leak on output open()") so the reference taken by bus_find_device_by_devt() is dropped after use in intel_th_output_open()/intel_th_output_release() paths.

Event History

Aug 10, 2026
CVE Published
via MITRE·11:59 AM
Data Sourced
via MITRE·11:59 AM
Description
Data Sourced
via NVD·01:20 PM
Description
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2026-68180?

The severity of CVE-2026-68180 is rated at 11.

2

What type of vulnerability is CVE-2026-68180?

CVE-2026-68180 is a reference leak vulnerability in the Linux kernel's intel_th component.

3

How do I fix CVE-2026-68180?

To fix CVE-2026-68180, you should update your Linux kernel to the version that includes the commit fixing the reference leak.

4

Which components are affected by CVE-2026-68180?

CVE-2026-68180 affects the intel_th output device handling in the Linux kernel.

5

Is CVE-2026-68180 a local or remote vulnerability?

CVE-2026-68180 is considered a local vulnerability since it requires local access to be exploited.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203