CVE-2026-68180: intel_th: fix MSC output device reference leak

Severity: unknown
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-10 · updated 2026-08-19

Description

In the Linux kernel, the following vulnerability has been resolved: intel_th: fix MSC output device reference leak intel_th_output_open() looks up the output device with bus_find_device_by_devt(), which returns the device with a reference that must be dropped after use. commit 95fc36a234da ("intel_th: fix device leak on output open()") attempted to drop the reference from intel_th_output_release(). However, a successful open replaces file->f_op with the output driver file operations before returning, so close runs the output driver release callback instead. For MSC outputs, close runs intel_th_msc_release(), which only removes the per-file iterator and does not drop the device reference taken by intel_th_output_open(). Consequently, every successful MSC output open leaks one device reference. Drop the device reference from intel_th_msc_release(), which is the release path actually used for MSC output files. Remove the now-unused intel_th_output_release() callback from intel_th_output_fops.

Affected products

Linux kernel: from 5.10.249 before 5.10.265; from 5.15.199 before 5.15.216; from 6.1.162 before 6.1.183; from 6.6.122 before 6.6.148; from 6.12.68 before 6.12.101; from 6.18.8 before 6.18.42 — fixed in 5.10.265, 5.15.216, 6.1.183, 6.12.101, 6.18.42, 6.6.148

How to fix

Upgrade to a fixed version: Linux kernel 5.10.265, 5.15.216, 6.1.183, 6.12.101. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-68180 or the next vulnerability affects your stack