CVE-2026-23091None▾ SunlitIn the Linux kernel, the following vulnerability has been resolved: intel_th: fix device leak on output open() Make sure to drop the reference taken when looking up the th device during output device open() on errors and on close(). N…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 19.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.1%
0.1% → 0.1%
In the Linux kernel, the following vulnerability has been resolved:
intel_th: fix device leak on output open()
Make sure to drop the reference taken when looking up the th device during output device open() on errors and on close().
Note that a recent commit fixed the leak in a couple of open() error paths but not all of them, and the reference is still leaking on successful open().
Linux >= 39f4034693b7c7bd1fe4cb58c93259d600f55561 < af4b9467296b9a16ebc008147238070236982b6dLinux >= 39f4034693b7c7bd1fe4cb58c93259d600f55561 < 64015cbf06e8bb75b81ae95b997e847b55280f7fLinux >= 39f4034693b7c7bd1fe4cb58c93259d600f55561 < b71e64ef7ff9443835d1333e3e80ab1e49e5209fLinux >= 39f4034693b7c7bd1fe4cb58c93259d600f55561 < bf7785434b5d05d940d936b78925080950bd54ddLinux >= 39f4034693b7c7bd1fe4cb58c93259d600f55561 < 0fca16c5591534cc1fec8b6181277ee3a3d0f26cLinux >= 39f4034693b7c7bd1fe4cb58c93259d600f55561 < f9b059bda4276f2bb72cb98ec7875a747f042ea2Linux >= 39f4034693b7c7bd1fe4cb58c93259d600f55561 < 95fc36a234da24bbc5f476f8104a5a15f99ed3e3Linux 4.4Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-99118Nonedrm/i915/dmc: Harden DMC firmware payload parsing
CVE-2026-99117Nonenet: bridge: mcast: don't truncate the port group walk on teardown
CVE-2026-99121Noneipv4: avoid divide by zero in fib_rebalance
CVE-2026-99120NoneKVM: x86/mmu: Cope with the SS bit being set in #NPF exit codes
CVE-2026-99119Nonedrm/amdgpu/userq: actually validate userq BOs
CVE-2026-99123Nonevsock/virtio: validate packet source for connected sockets