CVE-2026-68180
Received Received - Intake

Device Reference Leak in Linux Kernel intel_th Driver

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: intel_th: fix MSC output device reference leak intel_th_output_open() looks up the output device with bus_find_device_by_devt(), which returns the device with a reference that must be dropped after use. commit 95fc36a234da ("intel_th: fix device leak on output open()") attempted to drop the reference from intel_th_output_release(). However, a successful open replaces file->f_op with the output driver file operations before returning, so close runs the output driver release callback instead. For MSC outputs, close runs intel_th_msc_release(), which only removes the per-file iterator and does not drop the device reference taken by intel_th_output_open(). Consequently, every successful MSC output open leaks one device reference. Drop the device reference from intel_th_msc_release(), which is the release path actually used for MSC output files. Remove the now-unused intel_th_output_release() callback from intel_th_output_fops.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-68180
EUVD
EUVD-2026-55281

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
intel linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a reference leak in the intel_th subsystem. When opening an MSC output device, a device reference is taken but not properly released, causing a leak with each successful open operation.

Detection Guidance

This vulnerability is specific to the Linux kernel's intel_th driver and does not have network-based detection methods. To detect it, check if your kernel version includes the vulnerable code by examining the intel_th driver source or logs for device reference leaks during MSC output operations.

Impact Analysis

The vulnerability can lead to resource exhaustion over time as device references accumulate. This may cause system instability, crashes, or degraded performance due to unmanaged memory and device references.

Mitigation Strategies

Apply the kernel patch that fixes the device reference leak in the intel_th driver. Update your Linux kernel to a version that includes the commit 95fc36a234da or later. If patching is not immediately possible, consider disabling the intel_th driver if it is not required for your system.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-68180. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart