---
id: CVE-2026-23091
title: 'intel_th: fix device leak on output open()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  intel_th: fix device leak on output open()

  Make sure to drop the reference taken when looking up the th device
  during output device open() on errors and on close().

  N…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 39f4034693b7c7bd1fe4cb58c93259d600f55561 <
    af4b9467296b9a16ebc008147238070236982b6d
  - >-
    Linux >= 39f4034693b7c7bd1fe4cb58c93259d600f55561 <
    64015cbf06e8bb75b81ae95b997e847b55280f7f
  - >-
    Linux >= 39f4034693b7c7bd1fe4cb58c93259d600f55561 <
    b71e64ef7ff9443835d1333e3e80ab1e49e5209f
  - >-
    Linux >= 39f4034693b7c7bd1fe4cb58c93259d600f55561 <
    bf7785434b5d05d940d936b78925080950bd54dd
  - >-
    Linux >= 39f4034693b7c7bd1fe4cb58c93259d600f55561 <
    0fca16c5591534cc1fec8b6181277ee3a3d0f26c
  - >-
    Linux >= 39f4034693b7c7bd1fe4cb58c93259d600f55561 <
    f9b059bda4276f2bb72cb98ec7875a747f042ea2
  - >-
    Linux >= 39f4034693b7c7bd1fe4cb58c93259d600f55561 <
    95fc36a234da24bbc5f476f8104a5a15f99ed3e3
  - Linux 4.4
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-06-10T20:42:22.525510Z'
published: '2026-02-04'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T18:25:30.355Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-23091'
references:
  - url: 'https://git.kernel.org/stable/c/af4b9467296b9a16ebc008147238070236982b6d'
  - url: 'https://git.kernel.org/stable/c/64015cbf06e8bb75b81ae95b997e847b55280f7f'
  - url: 'https://git.kernel.org/stable/c/b71e64ef7ff9443835d1333e3e80ab1e49e5209f'
  - url: 'https://git.kernel.org/stable/c/bf7785434b5d05d940d936b78925080950bd54dd'
  - url: 'https://git.kernel.org/stable/c/0fca16c5591534cc1fec8b6181277ee3a3d0f26c'
  - url: 'https://git.kernel.org/stable/c/f9b059bda4276f2bb72cb98ec7875a747f042ea2'
  - url: 'https://git.kernel.org/stable/c/95fc36a234da24bbc5f476f8104a5a15f99ed3e3'
tags:
  - cve.org
epss: 0.00144
epssPercentile: 0.03652
ingestedAt: '2026-10-19T18:35:50.105Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

intel_th: fix device leak on output open()

Make sure to drop the reference taken when looking up the th device
during output device open() on errors and on close().

Note that a recent commit fixed the leak in a couple of open() error
paths but not all of them, and the reference is still leaking on
successful open().

## Affected

- `Linux >= 39f4034693b7c7bd1fe4cb58c93259d600f55561 < af4b9467296b9a16ebc008147238070236982b6d`
- `Linux >= 39f4034693b7c7bd1fe4cb58c93259d600f55561 < 64015cbf06e8bb75b81ae95b997e847b55280f7f`
- `Linux >= 39f4034693b7c7bd1fe4cb58c93259d600f55561 < b71e64ef7ff9443835d1333e3e80ab1e49e5209f`
- `Linux >= 39f4034693b7c7bd1fe4cb58c93259d600f55561 < bf7785434b5d05d940d936b78925080950bd54dd`
- `Linux >= 39f4034693b7c7bd1fe4cb58c93259d600f55561 < 0fca16c5591534cc1fec8b6181277ee3a3d0f26c`
- `Linux >= 39f4034693b7c7bd1fe4cb58c93259d600f55561 < f9b059bda4276f2bb72cb98ec7875a747f042ea2`
- `Linux >= 39f4034693b7c7bd1fe4cb58c93259d600f55561 < 95fc36a234da24bbc5f476f8104a5a15f99ed3e3`
- `Linux 4.4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.