{"id":"CVE-2026-68180","summary":"intel_th: fix MSC output device reference leak","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nintel_th: fix MSC output device reference leak\n\nintel_th_output_open() looks up the output device with\nbus_find_device_by_devt(), which returns the device with a reference that\nmust be dropped after use.\n\ncommit 95fc36a234da (\"intel_th: fix device leak on output open()\")\nattempted to drop the reference from intel_th_output_release(). However,\na successful open replaces file-\u003ef_op with the output driver file\noperations before returning, so close runs the output driver release\ncallback instead.\n\nFor MSC outputs, close runs intel_th_msc_release(), which only removes\nthe per-file iterator and does not drop the device reference taken by\nintel_th_output_open(). Consequently, every successful MSC output open\nleaks one device reference.\n\nDrop the device reference from intel_th_msc_release(), which is the\nrelease path actually used for MSC output files. Remove the now-unused\nintel_th_output_release() callback from intel_th_output_fops.","modified":"2026-09-30T18:26:55.511407181Z","published":"2026-08-10T11:59:51.694Z","related":["SUSE-SU-2026:23477-1","SUSE-SU-2026:23481-1","SUSE-SU-2026:23528-1","SUSE-SU-2026:23529-1","SUSE-SU-2026:23881-1","SUSE-SU-2026:23887-1","SUSE-SU-2026:23897-1","SUSE-SU-2026:23902-1","SUSE-SU-2026:4120-1","SUSE-SU-2026:4254-1","openSUSE-SU-2026:21910-1"],"database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68180.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/12ad4fad748e6e563ff4480f03b89134a41b5c37"},{"type":"WEB","url":"https://git.kernel.org/stable/c/141641a70ed337e54487f766ede745fc2ce44c42"},{"type":"WEB","url":"https://git.kernel.org/stable/c/26e27b8dcef1e4df6f30d8f25b3304a506d482b3"},{"type":"WEB","url":"https://git.kernel.org/stable/c/761b785a0cfbce43761227bc42a7f984f31f8921"},{"type":"WEB","url":"https://git.kernel.org/stable/c/c3a28f9cb82425fe0835048ed3677f321e780691"},{"type":"WEB","url":"https://git.kernel.org/stable/c/caba30eb8bd321c465ecfc7d850ee85f5b353496"},{"type":"WEB","url":"https://git.kernel.org/stable/c/ddcf2064d7ec5a8c9afa7cb74442320e443502bc"},{"type":"WEB","url":"https://git.kernel.org/stable/c/df55842fddbcdb80e6dd16680439c0f780ed592e"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68180.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68180"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"af4b9467296b9a16ebc008147238070236982b6d"},{"fixed":"12ad4fad748e6e563ff4480f03b89134a41b5c37"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"64015cbf06e8bb75b81ae95b997e847b55280f7f"},{"fixed":"df55842fddbcdb80e6dd16680439c0f780ed592e"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"b71e64ef7ff9443835d1333e3e80ab1e49e5209f"},{"fixed":"141641a70ed337e54487f766ede745fc2ce44c42"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"bf7785434b5d05d940d936b78925080950bd54dd"},{"fixed":"ddcf2064d7ec5a8c9afa7cb74442320e443502bc"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"0fca16c5591534cc1fec8b6181277ee3a3d0f26c"},{"fixed":"26e27b8dcef1e4df6f30d8f25b3304a506d482b3"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"f9b059bda4276f2bb72cb98ec7875a747f042ea2"},{"fixed":"caba30eb8bd321c465ecfc7d850ee85f5b353496"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"95fc36a234da24bbc5f476f8104a5a15f99ed3e3"},{"fixed":"c3a28f9cb82425fe0835048ed3677f321e780691"},{"fixed":"761b785a0cfbce43761227bc42a7f984f31f8921"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"5.10.249"},{"fixed":"5.10.265"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"5.15.199"},{"fixed":"5.15.216"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"6.1.162"},{"fixed":"6.1.183"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"6.6.122"},{"fixed":"6.6.148"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"6.12.68"},{"fixed":"6.12.101"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"6.18.8"},{"fixed":"6.18.42"}]}],"versions":["v5.10.264","v5.10.263","v5.10.262","v5.10.261","v5.10.260","v5.10.259","v5.10.258","v5.10.257","v5.10.256","v5.10.255","v5.10.254","v5.10.253","v5.10.252","v5.10.251","v5.10.250","v5.10.249","v5.15.215","v5.15.214","v5.15.213","v5.15.212","v5.15.211","v5.15.210","v5.15.209","v5.15.208","v5.15.207","v5.15.206","v5.15.205","v5.15.204","v5.15.203","v5.15.202","v5.15.201","v5.15.200","v5.15.199","v6.1.182","v6.1.181","v6.1.180","v6.1.179","v6.1.178","v6.1.177","v6.1.176","v6.1.175","v6.1.174","v6.1.173","v6.1.172","v6.1.171","v6.1.170","v6.1.169","v6.1.168","v6.1.167","v6.1.166","v6.1.165","v6.1.164","v6.1.163","v6.1.162","v6.6.147","v6.6.146","v6.6.145","v6.6.144","v6.6.143","v6.6.142","v6.6.141","v6.6.140","v6.6.139","v6.6.138","v6.6.137","v6.6.136","v6.6.135","v6.6.134","v6.6.133","v6.6.132","v6.6.131","v6.6.130","v6.6.129","v6.6.128","v6.6.127","v6.6.126","v6.6.125","v6.6.124","v6.6.123","v6.6.122","v6.12.100","v6.12.99","v6.12.98","v6.12.97","v6.12.96","v6.12.95","v6.12.94","v6.12.93","v6.12.92","v6.12.91","v6.12.90","v6.12.89","v6.12.88","v6.12.87","v6.12.86","v6.12.85","v6.12.84","v6.12.83","v6.12.82","v6.12.81","v6.12.80","v6.12.79","v6.12.78","v6.12.77","v6.12.76","v6.12.75","v6.12.74","v6.12.73","v6.12.72","v6.12.71","v6.12.70","v6.12.69","v6.12.68","v6.18.41","v6.18.40","v6.18.39","v6.18.38","v6.18.37","v6.18.36","v6.18.35","v6.18.34","v6.18.33","v6.18.32","v6.18.31","v6.18.30","v6.18.29","v6.18.28","v6.18.27","v6.18.26","v6.18.25","v6.18.24","v6.18.23","v6.18.22","v6.18.21","v6.18.20","v6.18.19","v6.18.18","v6.18.17","v6.18.16","v6.18.15","v6.18.14","v6.18.13","v6.18.12","v6.18.11","v6.18.10","v6.18.9","v6.18.8"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-68180.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.265"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.11.0"},{"fixed":"5.15.216"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"6.1.183"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.148"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.101"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.42"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.1.6"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-68180.json"}}],"schema_version":"1.9.0"}