---
id: CVE-2026-68180
title: 'intel_th: fix MSC output device reference leak'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  intel_th: fix MSC output device reference leak

  intel_th_output_open() looks up the output device with
  bus_find_device_by_devt(), which returns the device with a refere…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= af4b9467296b9a16ebc008147238070236982b6d <
    12ad4fad748e6e563ff4480f03b89134a41b5c37
  - >-
    Linux >= 64015cbf06e8bb75b81ae95b997e847b55280f7f <
    df55842fddbcdb80e6dd16680439c0f780ed592e
  - >-
    Linux >= b71e64ef7ff9443835d1333e3e80ab1e49e5209f <
    141641a70ed337e54487f766ede745fc2ce44c42
  - >-
    Linux >= bf7785434b5d05d940d936b78925080950bd54dd <
    ddcf2064d7ec5a8c9afa7cb74442320e443502bc
  - >-
    Linux >= 0fca16c5591534cc1fec8b6181277ee3a3d0f26c <
    26e27b8dcef1e4df6f30d8f25b3304a506d482b3
  - >-
    Linux >= f9b059bda4276f2bb72cb98ec7875a747f042ea2 <
    caba30eb8bd321c465ecfc7d850ee85f5b353496
  - >-
    Linux >= 95fc36a234da24bbc5f476f8104a5a15f99ed3e3 <
    c3a28f9cb82425fe0835048ed3677f321e780691
  - >-
    Linux >= 95fc36a234da24bbc5f476f8104a5a15f99ed3e3 <
    761b785a0cfbce43761227bc42a7f984f31f8921
  - Linux >= 5.10.249 < 5.10.265
  - Linux >= 5.15.199 < 5.15.216
  - Linux >= 6.1.162 < 6.1.183
  - Linux >= 6.6.122 < 6.6.148
  - Linux >= 6.12.68 < 6.12.101
  - Linux >= 6.18.8 < 6.18.42
  - Linux 6.19
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T16:43:45.453776Z'
published: '2026-08-10'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T16:45:00.616Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-68180'
references:
  - url: 'https://git.kernel.org/stable/c/12ad4fad748e6e563ff4480f03b89134a41b5c37'
  - url: 'https://git.kernel.org/stable/c/df55842fddbcdb80e6dd16680439c0f780ed592e'
  - url: 'https://git.kernel.org/stable/c/141641a70ed337e54487f766ede745fc2ce44c42'
  - url: 'https://git.kernel.org/stable/c/ddcf2064d7ec5a8c9afa7cb74442320e443502bc'
  - url: 'https://git.kernel.org/stable/c/26e27b8dcef1e4df6f30d8f25b3304a506d482b3'
  - url: 'https://git.kernel.org/stable/c/caba30eb8bd321c465ecfc7d850ee85f5b353496'
  - url: 'https://git.kernel.org/stable/c/c3a28f9cb82425fe0835048ed3677f321e780691'
  - url: 'https://git.kernel.org/stable/c/761b785a0cfbce43761227bc42a7f984f31f8921'
tags:
  - cve.org
epss: 0.00216
epssPercentile: 0.12145
ingestedAt: '2026-11-06T16:57:43.140Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

intel_th: fix MSC output device reference leak

intel_th_output_open() looks up the output device with
bus_find_device_by_devt(), which returns the device with a reference that
must be dropped after use.

commit 95fc36a234da ("intel_th: fix device leak on output open()")
attempted to drop the reference from intel_th_output_release(). However,
a successful open replaces file->f_op with the output driver file
operations before returning, so close runs the output driver release
callback instead.

For MSC outputs, close runs intel_th_msc_release(), which only removes
the per-file iterator and does not drop the device reference taken by
intel_th_output_open(). Consequently, every successful MSC output open
leaks one device reference.

Drop the device reference from intel_th_msc_release(), which is the
release path actually used for MSC output files. Remove the now-unused
intel_th_output_release() callback from intel_th_output_fops.

## Affected

- `Linux >= af4b9467296b9a16ebc008147238070236982b6d < 12ad4fad748e6e563ff4480f03b89134a41b5c37`
- `Linux >= 64015cbf06e8bb75b81ae95b997e847b55280f7f < df55842fddbcdb80e6dd16680439c0f780ed592e`
- `Linux >= b71e64ef7ff9443835d1333e3e80ab1e49e5209f < 141641a70ed337e54487f766ede745fc2ce44c42`
- `Linux >= bf7785434b5d05d940d936b78925080950bd54dd < ddcf2064d7ec5a8c9afa7cb74442320e443502bc`
- `Linux >= 0fca16c5591534cc1fec8b6181277ee3a3d0f26c < 26e27b8dcef1e4df6f30d8f25b3304a506d482b3`
- `Linux >= f9b059bda4276f2bb72cb98ec7875a747f042ea2 < caba30eb8bd321c465ecfc7d850ee85f5b353496`
- `Linux >= 95fc36a234da24bbc5f476f8104a5a15f99ed3e3 < c3a28f9cb82425fe0835048ed3677f321e780691`
- `Linux >= 95fc36a234da24bbc5f476f8104a5a15f99ed3e3 < 761b785a0cfbce43761227bc42a7f984f31f8921`
- `Linux >= 5.10.249 < 5.10.265`
- `Linux >= 5.15.199 < 5.15.216`
- `Linux >= 6.1.162 < 6.1.183`
- `Linux >= 6.6.122 < 6.6.148`
- `Linux >= 6.12.68 < 6.12.101`
- `Linux >= 6.18.8 < 6.18.42`
- `Linux 6.19`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.