CVE-2026-68180: intel_th: fix MSC output device reference leak

CVE-2026-68180: intel_th: fix MSC output device reference leak

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

intel_th: fix MSC output device reference leak

intel_th_output_open() looks up the output device with
bus_find_device_by_devt(), which returns the device with a reference that
must be dropped after use.

commit 95fc36a234da ("intel_th: fix device leak on output open()")
attempted to drop the reference from intel_th_output_release(). However,
a successful open replaces file->f_op with the output driver file
operations before returning, so close runs the output driver release
callback instead.

For MSC outputs, close runs intel_th_msc_release(), which only removes
the per-file iterator and does not drop the device reference taken by
intel_th_output_open(). Consequently, every successful MSC output open
leaks one device reference.

Drop the device reference from intel_th_msc_release(), which is the
release path actually used for MSC output files. Remove the now-unused
intel_th_output_release() callback from intel_th_output_fops.

The Linux kernel CVE team has assigned CVE-2026-68180 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.6.122 with commit bf7785434b5d05d940d936b78925080950bd54dd and fixed in 6.6.148 with commit ddcf2064d7ec5a8c9afa7cb74442320e443502bc
	Issue introduced in 6.12.68 with commit 0fca16c5591534cc1fec8b6181277ee3a3d0f26c and fixed in 6.12.101 with commit 26e27b8dcef1e4df6f30d8f25b3304a506d482b3
	Issue introduced in 6.18.8 with commit f9b059bda4276f2bb72cb98ec7875a747f042ea2 and fixed in 6.18.42 with commit caba30eb8bd321c465ecfc7d850ee85f5b353496
	Issue introduced in 6.19 with commit 95fc36a234da24bbc5f476f8104a5a15f99ed3e3 and fixed in 7.1.6 with commit c3a28f9cb82425fe0835048ed3677f321e780691
	Issue introduced in 6.19 with commit 95fc36a234da24bbc5f476f8104a5a15f99ed3e3 and fixed in 7.2-rc5 with commit 761b785a0cfbce43761227bc42a7f984f31f8921
	Issue introduced in 5.10.249 with commit af4b9467296b9a16ebc008147238070236982b6d
	Issue introduced in 5.15.199 with commit 64015cbf06e8bb75b81ae95b997e847b55280f7f
	Issue introduced in 6.1.162 with commit b71e64ef7ff9443835d1333e3e80ab1e49e5209f

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-68180
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/hwtracing/intel_th/core.c
	drivers/hwtracing/intel_th/msu.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/ddcf2064d7ec5a8c9afa7cb74442320e443502bc
	https://git.kernel.org/stable/c/26e27b8dcef1e4df6f30d8f25b3304a506d482b3
	https://git.kernel.org/stable/c/caba30eb8bd321c465ecfc7d850ee85f5b353496
	https://git.kernel.org/stable/c/c3a28f9cb82425fe0835048ed3677f321e780691
	https://git.kernel.org/stable/c/761b785a0cfbce43761227bc42a7f984f31f8921