CVE-2026-68180 - Vulnerability Details

- intel_th: fix MSC output device reference leak

Description

In the Linux kernel, the following vulnerability has been resolved:

intel_th: fix MSC output device reference leak

intel_th_output_open() looks up the output device with
bus_find_device_by_devt(), which returns the device with a reference that
must be dropped after use.

commit 95fc36a234da ("intel_th: fix device leak on output open()")
attempted to drop the reference from intel_th_output_release(). However,
a successful open replaces file->f_op with the output driver file
operations before returning, so close runs the output driver release
callback instead.

For MSC outputs, close runs intel_th_msc_release(), which only removes
the per-file iterator and does not drop the device reference taken by
intel_th_output_open(). Consequently, every successful MSC output open
leaks one device reference.

Drop the device reference from intel_th_msc_release(), which is the
release path actually used for MSC output files. Remove the now-unused
intel_th_output_release() callback from intel_th_output_fops.

Published: 2026-08-10

Score: n/a

EPSS: n/a

KEV: No

Impact:

Action:

Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`bf7785434b5d05d940d936b78925080950bd54dd`	affected	< ddcf2064d7ec5a8c9afa7cb74442320e443502bc
`0fca16c5591534cc1fec8b6181277ee3a3d0f26c`	affected	< 26e27b8dcef1e4df6f30d8f25b3304a506d482b3
`f9b059bda4276f2bb72cb98ec7875a747f042ea2`	affected	< caba30eb8bd321c465ecfc7d850ee85f5b353496
`95fc36a234da24bbc5f476f8104a5a15f99ed3e3`	affected	< c3a28f9cb82425fe0835048ed3677f321e780691
`95fc36a234da24bbc5f476f8104a5a15f99ed3e3`	affected	< 761b785a0cfbce43761227bc42a7f984f31f8921
`af4b9467296b9a16ebc008147238070236982b6d`	affected	—
`64015cbf06e8bb75b81ae95b997e847b55280f7f`	affected	—
`b71e64ef7ff9443835d1333e3e80ab1e49e5209f`	affected	—
`6.6.122`	affected	< 6.6.148
`6.12.68`	affected	< 6.12.101
`6.18.8`	affected	< 6.18.42
`5.10.249`	affected	< 5.11
`5.15.199`	affected	< 5.16
`6.1.162`	affected	< 6.2

Linux

affected

Version	Status	Constraints
`6.19`	affected	—
`0`	unaffected	< 6.19
`6.6.148`	unaffected	≤ 6.6.*
`6.12.101`	unaffected	≤ 6.12.*
`6.18.42`	unaffected	≤ 6.18.*
`7.1.6`	unaffected	≤ 7.1.*
`7.2-rc5`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[bf7785434b5d05d940d936b78925080950bd54dd,ddcf2064d7ec5a8c9afa7cb74442320e443502bc)`	affected	code_commit	—
`[0fca16c5591534cc1fec8b6181277ee3a3d0f26c,26e27b8dcef1e4df6f30d8f25b3304a506d482b3)`	affected	code_commit	—
`[f9b059bda4276f2bb72cb98ec7875a747f042ea2,caba30eb8bd321c465ecfc7d850ee85f5b353496)`	affected	code_commit	—
`[95fc36a234da24bbc5f476f8104a5a15f99ed3e3,c3a28f9cb82425fe0835048ed3677f321e780691)`	affected	code_commit	—
`[95fc36a234da24bbc5f476f8104a5a15f99ed3e3,761b785a0cfbce43761227bc42a7f984f31f8921)`	affected	code_commit	—
`af4b9467296b9a16ebc008147238070236982b6d`	affected	code_commit	—
`64015cbf06e8bb75b81ae95b997e847b55280f7f`	affected	code_commit	—
`b71e64ef7ff9443835d1333e3e80ab1e49e5209f`	affected	code_commit	—
`[6.6.122,6.6.148)`	affected	semver	—
`[6.12.68,6.12.101)`	affected	semver	—
`[6.18.8,6.18.42)`	affected	semver	—
`[5.10.249,5.11)`	affected	generic	—
`[5.15.199,5.16)`	affected	generic	—
`[6.1.162,6.2)`	affected	generic	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.19`	affected	generic	—
`[0,6.19)`	unaffected	generic	—
`[6.6.148,6.7.0)`	unaffected	semver	—
`[6.12.101,6.13.0)`	unaffected	semver	—
`[6.18.42,6.19.0)`	unaffected	semver	—
`[7.1.6,7.2.0)`	unaffected	semver	—
`[7.2-rc5,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/26e27b8dcef1e4df6f30d8f25b3304a506d482b3
https://git.kernel.org/stable/c/761b785a0cfbce43761227bc42a7f984f31f8921
https://git.kernel.org/stable/c/c3a28f9cb82425fe0835048ed3677f321e780691
https://git.kernel.org/stable/c/caba30eb8bd321c465ecfc7d850ee85f5b353496
https://git.kernel.org/stable/c/ddcf2064d7ec5a8c9afa7cb74442320e443502bc

History

Mon, 10 Aug 2026 15:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-912

Mon, 10 Aug 2026 12:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: intel_th: fix MSC output device reference leak intel_th_output_open() looks up the output device with bus_find_device_by_devt(), which returns the device with a reference that must be dropped after use. commit 95fc36a234da ("intel_th: fix device leak on output open()") attempted to drop the reference from intel_th_output_release(). However, a successful open replaces file->f_op with the output driver file operations before returning, so close runs the output driver release callback instead. For MSC outputs, close runs intel_th_msc_release(), which only removes the per-file iterator and does not drop the device reference taken by intel_th_output_open(). Consequently, every successful MSC output open leaks one device reference. Drop the device reference from intel_th_msc_release(), which is the release path actually used for MSC output files. Remove the now-unused intel_th_output_release() callback from intel_th_output_fops.
Title		intel_th: fix MSC output device reference leak
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/26e27b8dcef1e4df6f30d8f25b3304a506d482b3 https://git.kernel.org/stable/c/761b785a0cfbce43761227bc42a7f984f31f8921 https://git.kernel.org/stable/c/c3a28f9cb82425fe0835048ed3677f321e780691 https://git.kernel.org/stable/c/caba30eb8bd321c465ecfc7d850ee85f5b353496 https://git.kernel.org/stable/c/ddcf2064d7ec5a8c9afa7cb74442320e443502bc

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-10T11:59:51.694Z

Updated: 2026-08-10T11:59:51.694Z

Reserved: 2026-07-30T09:28:09.373Z

Link: CVE-2026-68180

Vulnrichment

No data.

NVD

No data.

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-08-10T17:15:02Z

Weaknesses

CWE-912
Hidden Functionality

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object