{"id":"CVE-2026-68180","title":"intel_th: fix MSC output device reference leak","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nintel_th: fix MSC output device reference leak\n\nintel_th_output_open() looks up the output device with\nbus_find_device_by_devt(), which returns the device with a refere…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= af4b9467296b9a16ebc008147238070236982b6d < 12ad4fad748e6e563ff4480f03b89134a41b5c37","Linux >= 64015cbf06e8bb75b81ae95b997e847b55280f7f < df55842fddbcdb80e6dd16680439c0f780ed592e","Linux >= b71e64ef7ff9443835d1333e3e80ab1e49e5209f < 141641a70ed337e54487f766ede745fc2ce44c42","Linux >= bf7785434b5d05d940d936b78925080950bd54dd < ddcf2064d7ec5a8c9afa7cb74442320e443502bc","Linux >= 0fca16c5591534cc1fec8b6181277ee3a3d0f26c < 26e27b8dcef1e4df6f30d8f25b3304a506d482b3","Linux >= f9b059bda4276f2bb72cb98ec7875a747f042ea2 < caba30eb8bd321c465ecfc7d850ee85f5b353496","Linux >= 95fc36a234da24bbc5f476f8104a5a15f99ed3e3 < c3a28f9cb82425fe0835048ed3677f321e780691","Linux >= 95fc36a234da24bbc5f476f8104a5a15f99ed3e3 < 761b785a0cfbce43761227bc42a7f984f31f8921","Linux >= 5.10.249 < 5.10.265","Linux >= 5.15.199 < 5.15.216","Linux >= 6.1.162 < 6.1.183","Linux >= 6.6.122 < 6.6.148","Linux >= 6.12.68 < 6.12.101","Linux >= 6.18.8 < 6.18.42","Linux 6.19"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-06T16:43:45.453776Z"},"published":"2026-08-10","updated":"2026-11-06","sourceUpdated":"2026-11-06T16:45:00.616Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-68180","references":[{"url":"https://git.kernel.org/stable/c/12ad4fad748e6e563ff4480f03b89134a41b5c37"},{"url":"https://git.kernel.org/stable/c/df55842fddbcdb80e6dd16680439c0f780ed592e"},{"url":"https://git.kernel.org/stable/c/141641a70ed337e54487f766ede745fc2ce44c42"},{"url":"https://git.kernel.org/stable/c/ddcf2064d7ec5a8c9afa7cb74442320e443502bc"},{"url":"https://git.kernel.org/stable/c/26e27b8dcef1e4df6f30d8f25b3304a506d482b3"},{"url":"https://git.kernel.org/stable/c/caba30eb8bd321c465ecfc7d850ee85f5b353496"},{"url":"https://git.kernel.org/stable/c/c3a28f9cb82425fe0835048ed3677f321e780691"},{"url":"https://git.kernel.org/stable/c/761b785a0cfbce43761227bc42a7f984f31f8921"}],"tags":["cve.org"],"epss":0.00216,"epssPercentile":0.12145,"ingestedAt":"2026-11-06T16:57:43.140Z","slug":"CVE-2026-68180","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nintel_th: fix MSC output device reference leak\n\nintel_th_output_open() looks up the output device with\nbus_find_device_by_devt(), which returns the device with a reference that\nmust be dropped after use.\n\ncommit 95fc36a234da (\"intel_th: fix device leak on output open()\")\nattempted to drop the reference from intel_th_output_release(). However,\na successful open replaces file->f_op with the output driver file\noperations before returning, so close runs the output driver release\ncallback instead.\n\nFor MSC outputs, close runs intel_th_msc_release(), which only removes\nthe per-file iterator and does not drop the device reference taken by\nintel_th_output_open(). Consequently, every successful MSC output open\nleaks one device reference.\n\nDrop the device reference from intel_th_msc_release(), which is the\nrelease path actually used for MSC output files. Remove the now-unused\nintel_th_output_release() callback from intel_th_output_fops.\n\n## Affected\n\n- `Linux >= af4b9467296b9a16ebc008147238070236982b6d < 12ad4fad748e6e563ff4480f03b89134a41b5c37`\n- `Linux >= 64015cbf06e8bb75b81ae95b997e847b55280f7f < df55842fddbcdb80e6dd16680439c0f780ed592e`\n- `Linux >= b71e64ef7ff9443835d1333e3e80ab1e49e5209f < 141641a70ed337e54487f766ede745fc2ce44c42`\n- `Linux >= bf7785434b5d05d940d936b78925080950bd54dd < ddcf2064d7ec5a8c9afa7cb74442320e443502bc`\n- `Linux >= 0fca16c5591534cc1fec8b6181277ee3a3d0f26c < 26e27b8dcef1e4df6f30d8f25b3304a506d482b3`\n- `Linux >= f9b059bda4276f2bb72cb98ec7875a747f042ea2 < caba30eb8bd321c465ecfc7d850ee85f5b353496`\n- `Linux >= 95fc36a234da24bbc5f476f8104a5a15f99ed3e3 < c3a28f9cb82425fe0835048ed3677f321e780691`\n- `Linux >= 95fc36a234da24bbc5f476f8104a5a15f99ed3e3 < 761b785a0cfbce43761227bc42a7f984f31f8921`\n- `Linux >= 5.10.249 < 5.10.265`\n- `Linux >= 5.15.199 < 5.15.216`\n- `Linux >= 6.1.162 < 6.1.183`\n- `Linux >= 6.6.122 < 6.6.148`\n- `Linux >= 6.12.68 < 6.12.101`\n- `Linux >= 6.18.8 < 6.18.42`\n- `Linux 6.19`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}