CVE-2026-68180

intel_th_output_open() looks up the output device with bus_find_device_by_devt(), which returns the device with a reference that must be dropped after use.

commit 95fc36a234da ("intel_th: fix device leak on output open()") attempted to drop the reference from intel_th_output_release(). However, a successful open replaces file->f_op with the output driver file operations before returning, so close runs the output driver release callback instead.

For MSC outputs, close runs intel_th_msc_release(), which only removes the per-file iterator and does not drop the device reference taken by intel_th_output_open(). Consequently, every successful MSC output open leaks one device reference.

Drop the device reference from intel_th_msc_release(), which is the release path actually used for MSC output files. Remove the now-unused intel_th_output_release() callback from intel_th_output_fops.

Database specific

{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68180.json"
}

References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

af4b9467296b9a16ebc008147238070236982b6d

Fixed

12ad4fad748e6e563ff4480f03b89134a41b5c37

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

64015cbf06e8bb75b81ae95b997e847b55280f7f

Fixed

df55842fddbcdb80e6dd16680439c0f780ed592e

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

b71e64ef7ff9443835d1333e3e80ab1e49e5209f

Fixed

141641a70ed337e54487f766ede745fc2ce44c42

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

bf7785434b5d05d940d936b78925080950bd54dd

Fixed

ddcf2064d7ec5a8c9afa7cb74442320e443502bc

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

0fca16c5591534cc1fec8b6181277ee3a3d0f26c

Fixed

26e27b8dcef1e4df6f30d8f25b3304a506d482b3

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

f9b059bda4276f2bb72cb98ec7875a747f042ea2

Fixed

caba30eb8bd321c465ecfc7d850ee85f5b353496

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

95fc36a234da24bbc5f476f8104a5a15f99ed3e3

Fixed

c3a28f9cb82425fe0835048ed3677f321e780691

Fixed

761b785a0cfbce43761227bc42a7f984f31f8921

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

5.10.249

Fixed

5.10.265

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

5.15.199

Fixed

5.15.216

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

6.1.162

Fixed

6.1.183

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

6.6.122

Fixed

6.6.148

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

6.12.68

Fixed

6.12.101

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

6.18.8

Fixed

6.18.42

Affected versions

v5.*

v5.10.249

v5.10.250

v5.10.251

v5.10.252

v5.10.253

v5.10.254

v5.10.255

v5.10.256

v5.10.257

v5.10.258

v5.10.259

v5.10.260

v5.10.261

v5.10.262

v5.10.263

v5.10.264

v5.15.199

v5.15.200

v5.15.201

v5.15.202

v5.15.203

v5.15.204

v5.15.205

v5.15.206

v5.15.207

v5.15.208

v5.15.209

v5.15.210

v5.15.211

v5.15.212

v5.15.213

v5.15.214

v5.15.215

v6.*

v6.1.162

v6.1.163

v6.1.164

v6.1.165

v6.1.166

v6.1.167

v6.1.168

v6.1.169

v6.1.170

v6.1.171

v6.1.172

v6.1.173

v6.1.174

v6.1.175

v6.1.176

v6.1.177

v6.1.178

v6.1.179

v6.1.180

v6.1.181

v6.1.182

v6.12.100

v6.12.68

v6.12.69

v6.12.70

v6.12.71

v6.12.72

v6.12.73

v6.12.74

v6.12.75

v6.12.76

v6.12.77

v6.12.78

v6.12.79

v6.12.80

v6.12.81

v6.12.82

v6.12.83

v6.12.84

v6.12.85

v6.12.86

v6.12.87

v6.12.88

v6.12.89

v6.12.90

v6.12.91

v6.12.92

v6.12.93

v6.12.94

v6.12.95

v6.12.96

v6.12.97

v6.12.98

v6.12.99

v6.18.10

v6.18.11

v6.18.12

v6.18.13

v6.18.14

v6.18.15

v6.18.16

v6.18.17

v6.18.18

v6.18.19

v6.18.20

v6.18.21

v6.18.22

v6.18.23

v6.18.24

v6.18.25

v6.18.26

v6.18.27

v6.18.28

v6.18.29

v6.18.30

v6.18.31

v6.18.32

v6.18.33

v6.18.34

v6.18.35

v6.18.36

v6.18.37

v6.18.38

v6.18.39

v6.18.40

v6.18.41

v6.18.8

v6.18.9

v6.6.122

v6.6.123

v6.6.124

v6.6.125

v6.6.126

v6.6.127

v6.6.128

v6.6.129

v6.6.130

v6.6.131

v6.6.132

v6.6.133

v6.6.134

v6.6.135

v6.6.136

v6.6.137

v6.6.138

v6.6.139

v6.6.140

v6.6.141

v6.6.142

v6.6.143

v6.6.144

v6.6.145

v6.6.146

v6.6.147

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-68180.json"

Linux / Kernel

Package

Name: Kernel

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

5.10.265

Type: ECOSYSTEM
Events: Introduced

5.11.0

Fixed

5.15.216

Type: ECOSYSTEM
Events: Introduced

5.16.0

Fixed

6.1.183

Type: ECOSYSTEM
Events: Introduced

6.2.0

Fixed

6.6.148

Type: ECOSYSTEM
Events: Introduced

6.7.0

Fixed

6.12.101

Type: ECOSYSTEM
Events: Introduced

6.13.0

Fixed

6.18.42

Type: ECOSYSTEM
Events: Introduced

6.19.0

Fixed

7.1.6

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-68180.json"