Cloudanix VulnDB

CVE-2026-68180

None

CVSS

—

EPSS

0.2%

Published

Aug 10, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux kernel's handling of certain Intel hardware tracing devices can slowly consume system resources and eventually affect stability if left unfixed.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

The vulnerability is a device reference leak in the intel_th driver: intel_th_output_open acquires a reference via bus_find_device_by_devt but intel_th_msc_release (the actual close path for MSC outputs) never drops it, so every successful open leaks one reference.

Why it matters to the business

On systems using Intel Trace Hub hardware, repeated MSC output activity can gradually exhaust kernel device references, leading to resource pressure, instability, or eventual denial of service.

How an attack unfolds

An attacker with local access opens MSC output device files repeatedly; each open succeeds and replaces the file operations, but the close path never releases the reference acquired at open time, accumulating leaks until the system is impacted.

How to fix it

Apply the upstream fix that moves the device reference drop into intel_th_msc_release and removes the unused intel_th_output_release callback; update to a kernel containing commit 95fc36a234da plus the follow-on correction.

How to confirm the fix worked

Inspect the intel_th_msc_release function for the presence of the device_put call on the output device; confirm that intel_th_output_release is no longer present in intel_th_output_fops; monitor reference counts across repeated open/close cycles.

Typical attack path

  1. Obtain local user access on a vulnerable Linux system
  2. Locate intel_th MSC output character devices
  3. Repeatedly open and close the devices to trigger reference leaks
  4. Continue until kernel resource exhaustion or instability occurs

How to detect it

Review auditd or kernel logs for high-frequency open/close events on intel_th MSC device paths; watch for steadily rising device reference counts or kmemleak reports mentioning intel_th output devices.

What your security team should do

  • Patch the Linux kernel on all systems exposing intel_th MSC devices as soon as vendor updates are available
  • Restrict local access to intel_th character devices via permissions or device filtering where operationally feasible
  • Include kernel reference-leak fixes in routine update and reboot cycles

The record

In the Linux kernel, the following vulnerability has been resolved: intel_th: fix MSC output device reference leak intel_th_output_open() looks up the output device with bus_find_device_by_devt(), which returns the device with a reference that must be dropped after use. commit 95fc36a234da ("intel_th: fix device leak on output open()") attempted to drop the reference from intel_th_output_release(). However, a successful open replaces file->f_op with the output driver file operations before returning, so close runs the output driver release callback instead. For MSC outputs, close runs intel_th_msc_release(), which only removes the per-file iterator and does not drop the device reference taken by intel_th_output_open(). Consequently, every successful MSC output open leaks one device reference. Drop the device reference from intel_th_msc_release(), which is the release path actually used for MSC output files. Remove the now-unused intel_th_output_release() callback from intel_th_output_fops.

Affected packages

Ecosystem Package Introduced Fixed